Network connection system and LAN accommodation apparatus connectable to network

Abstract

To provide a network connection system that strictly authenticates all devices connected to a LAN accommodation device and connects only the devices passing the authentication to a logical network and to provide the LAN accommodation device connectable to the network connection system.SOLUTION: A network connection system includes a LAN accommodating device for transmitting a passive request based on a printer information received from an external device to an authentication device, and an authentication device for managing connection authentication of a network, wherein the authentication device receives the passive request transmitted from the LAN accommodating device, compares the passive request with passive device authentication information recorded in a history storage device to perform authentication, and connects to the network when the connection is possible in the passive authentication process.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to a network connection system and a LAN accommodating device connectable to a network. [Background technology]

[0002] A LAN (Local Area Network) is a communication channel that connects IT devices (such as computers, servers, printers, etc.) within a company or organization. In recent years, LANs have become indispensable for using IT devices, and they must be maintained and managed properly and safely at all times.

[0003] However, in recent years, there have been cries of labor shortages in various areas, with the shortage of IT administrators being particularly pronounced. IT administrators are required to have a wide range of IT knowledge and skills, and they also need to constantly keep up to date with technology trends and product knowledge. It is difficult for not only small and medium-sized enterprises, but even large corporations, to continue employing such personnel. Furthermore, LAN management policies vary depending on the confidentiality of the information handled by the company, and there is no optimal solution that can be applied to all companies. As a result, even if the IT skills are the same, there are no best practices for LAN management like there are for programming, which means that it takes a long time to train IT administrators.

[0004] If a LAN is not properly managed, it may be vulnerable to unauthorized access from outside. This can lead to hacking and information leaks, which can cause huge losses for the company. Furthermore, if companies uniformly prohibit external access due to fear of unauthorized access, this can cause great inconvenience to employees and other users of IT resources.

[0005] As a solution to these problems, the installation of firewalls and VPN servers is widely used. These prevent unauthorized access from outside and allow only authorized users to access from outside. However, the introduction of these devices makes LAN management even more complicated and operation even more difficult.

[0006] One prior art solution to this complex problem is shown in Patent Document 1. This technology aims to enable the creation of a secure network without specialized knowledge by using an address translation function to create a logical network on the Internet. There is also a network connection system that enables secure network connections by authenticating each wireless LAN router when connecting to the network. [Prior art documents] [Patent documents]

[0007] [Patent Document 1] Patent Publication No. 2016-82555 [Non-Patent Document 1] ISO / IEC 7498-4:1989 "Information processing systems Open Systems Interconnection Basic Reference Model Part 4: Management framework" [Non-patent document 2] TCP / IP Network Management, 3rd Edition, Craig Hunt, Jun Murai, Yasuo Tsuchimoto, and Hideyuki Hayashi, O'Reilly Japan, 2003 Summary of the Invention [Problem to be solved by the invention]

[0008] However, the technology disclosed in Patent Document 1 has the problem that it does not authenticate PCs that do not have the dedicated client software installed, making it easy for them to be spoofed. Although the main function is address translation, it does not provide sufficient means for checking for spoofed addresses. As a result, even if an unauthorized terminal infiltrates the LAN, it cannot be detected or excluded.

[0009] Furthermore, even if authentication is performed for each wireless LAN router when connecting to a network, the devices themselves connected to the wireless LAN router are not authenticated, and if an IT device with malicious intent is connected to the wireless LAN router, it can be infiltrated into the network. Furthermore, if authentication information is stored in a portable wireless LAN router, the connection information can be stolen if the wireless LAN router is taken by a malicious third party.

[0010] In order to solve the above-mentioned problems, the present invention aims to provide a network connection system that performs strict authentication on all devices connected to a LAN accommodating device and connects only those that pass the authentication to a logical network, and a LAN accommodating device that can be connected to a network connection system. [Means for solving the problem]

[0011] The present invention is a network connection system including a LAN accommodating device that transmits a passive request based on fingerprint information received from an external device to an authentication device, and an authentication device that manages network connection authentication, characterized in that it comprises: a process in which the authentication device receives the passive request transmitted from the LAN accommodating device; a passive authentication process in which the authentication device compares the passive request with passive device authentication information recorded in a history storage device to perform authentication; and a network connection process in which the network is connected if connection is possible in the passive authentication process.

[0012] The present invention also provides a network connection system including a LAN accommodating device that transmits passive requests based on fingerprint information received from an external device and active requests from the device or a user operating the device, and an authentication device that manages network connection authentication, characterized by comprising: a process by which the authentication device receives the passive request transmitted from the LAN accommodating device; a passive authentication process by which the authentication device compares the passive request with passive device authentication information recorded in a history storage device and performs authentication; a process by which the authentication device receives the active request transmitted from the LAN accommodating device if connection is possible in the passive authentication process; an active authentication process by which the authentication device compares the active request with active device authentication information recorded in the history storage device and performs authentication; and a network connection process by which the network is connected if connection is possible in the active authentication process.

[0013] The present invention also provides a network connection system characterized in that the authentication device includes a lockdown information recording step for recording the device information and / or the LAN accommodation device information that could not connect to the network as lockdown information.

[0014] The present invention also provides a network connection system that includes a management device that, in certain cases, makes it possible to propose return communication within the LAN accommodating device, or direct communication between the LAN accommodating devices, or either one of these communications.

[0015] The present invention also provides a network connection system further comprising a periodic re-authentication step in which the authentication device periodically re-authenticates the LAN accommodating device.

[0016] The present invention also provides a network connection system further comprising a periodic re-authentication step in which the LAN accommodating device periodically re-authenticates the device.

[0017] The present invention also provides a network connection system further comprising a traffic filtering step in which the LAN accommodating device performs traffic filtering.

[0018] The present invention also provides a LAN accommodating device that does not record information obtained from a device to be transmitted to the authentication device.

[0019] As described above, the present invention provides a network connection system and a LAN accommodating device that directs communication traffic from connected devices to a logical network located at a center or the like. This LAN accommodating device is managed by the center and controlled based on instructions from the center. Furthermore, LAN accommodating devices are periodically authenticated by the center to confirm their health. If a LAN accommodating device fails this authentication, it undergoes lockdown processing, disconnecting all connected devices from the logical network and blocking communication traffic. In this way, strict authentication is performed on all devices connected to the LAN accommodating device, and only those that pass authentication are connected to the logical network, thereby providing a network connection system and a LAN accommodating device that can be connected to the network connection system that can properly and safely maintain and manage a network environment. [Brief explanation of the drawings]

[0020] [Figure 1] FIG. 1 is an explanatory diagram showing the configuration of a network connection system. [Figure 2] FIG. 2 is an explanatory diagram showing the operation of the network connection system. [Figure 3] FIG. 3 is an explanatory diagram showing the operation of the network connection system. [Figure 4] FIG. 4 is an explanatory diagram showing the configuration of a network connection system. [Figure 5] FIG. 5 is an explanatory diagram showing the configuration of a network connection system. BEST MODE FOR CARRYING OUT THE INVENTION

[0021] Figure 1 shows the most basic configuration of the network connection system of the present invention. In this configuration, communication traffic of all devices passes through a logical network (for mutual communication) created at the center. Example 1

[0022] Bases 1 and 2 are bases such as buildings or offices of companies or organizations where LAN accommodating devices (for example, wired LAN routers and wireless LAN routers) are installed.

[0023] LAN accommodating devices 1 and 2 are devices provided by the present invention. They are connected to the center via a wired communication path such as an optical fiber line or Ethernet, or a wireless communication path such as cellular communication, and accommodate multiple logical network connections within this communication path. Connection settings and control are performed from the center and cannot be performed from connected devices (for example, PCs or printers). Multiple devices can be connected to a LAN accommodating device at the same time, but in the initial state, the devices cannot communicate directly with each other or with the center.

[0024] The LAN accommodating device has the following functions: 1. A function to respond to setting requests (DHCP, etc.) from connected devices. 2. A function to acquire fingerprint information (unique information that identifies the device) of the connected device and send it to the center as a passive authentication request. 3. A function to forward active authentication requests from devices or users operating devices to the center; 4. A function to connect devices to a logical network such as a center based on instructions from the center. 5. Function to monitor the communication traffic of the device and send the results to the center; 6. A function to filter communication traffic from devices to prevent unnecessary communication traffic from entering logical networks such as centers. 7. A function to measure communication performance between the center and other LAN-accommodating devices and send the results to the center. 8. A function that enables direct communication between connected devices based on instructions from the center.

[0025] Logical networks 1-1, 1-2, 2-1, and 2-2 are logical networks created within the LAN accommodating device. These logical networks exist independently within the LAN accommodating device and are not initially connected to one another. One logical network exists for each device connected to the LAN accommodating device, and multiple devices are never connected at the same time. When devices are connected to a logical network such as a center by the LAN accommodating device, this means that these logical networks are connected to the logical network such as the center.

[0026] Devices 1-1, 1-2, 2-1, and 2-2 are various devices (such as PCs, printers, and scanners) with LAN connection capabilities that are connected to the LAN accommodating device. The devices themselves do not have the capability to connect to a logical network such as a center.

[0027] There are two types of devices that can be connected to a LAN accommodating device: 1. Devices that do not perform active authentication, and 2. Devices that perform active authentication.

[0028] Devices that do not perform active authentication are devices that do not have or cannot have agent software installed, such as printers and scanners. Devices that perform active authentication are devices that can install agent software, such as PCs and smartphones, to acquire device-specific information from within and send it as an active authentication request to a LAN-accommodated device. Alternatively, devices that can send authentication information as an active authentication request to a LAN-accommodated device by the user operating the device.

[0029] Users 1 and 2 are people who operate devices and are capable of making active authentication requests to LAN accommodating devices.

[0030] The center is a base of a service provider that provides a data center or cloud service.

[0031] The management device is a physical or virtual server located at a center. It provides a management console that can be used by an IT administrator remotely via a web browser, etc. It manages the registration of LAN accommodation devices, devices, and users. It can also define the logical network, such as a center, to which a device should connect for each authentication level of the device or device-user combination. When a device is connected to the LAN accommodation device, this definition is used to instruct the LAN accommodation device to connect to the logical network, such as a center. It can also limit the devices that can communicate with the logical network, such as a center, that is connected to the device. In this case, the LAN accommodation device filters communications and discards communication traffic other than that to which communication is permitted.

[0032] The authentication device is a device placed at the center and is a physical or virtual server. There are three targets for authentication: 1. LAN accommodating device, 2. device connected to LAN accommodating device, and 3. user operating the device. Authentication for LAN accommodating device is initiated by the authentication device and is performed periodically.

[0033] There are two types of authentication for devices connected to a LAN accommodating device: 1. passive authentication and 2. active authentication. In passive authentication, the LAN accommodating device periodically collects the device's fingerprint information (unique information that identifies the device) from outside and sends it to the authentication device as an authentication request. In active authentication, agent software installed on the device collects the device's unique information from inside and sends it to the authentication device via the LAN accommodating device at any time. Authentication operations performed by device users are also sent to the authentication device via the LAN accommodating device as active authentication at any time. These authentications refer to the registration status in the management device as well as the information stored in the monitoring history storage device. The authentication results are sent to the management device, which issues instructions to the LAN accommodating device based on the settings.

[0034] The monitoring history storage device is a physical or virtual server located at the center. The following five items are stored: 1. Information regarding the authentication of LAN accommodating devices (LAN accommodating device authentication information), 2. Information regarding the passive authentication of the device (passive device authentication information); 3. Information regarding the active authentication of devices and users (active device authentication information); 4. Information about the communication traffic of the device; 5. Information on communication performance between each LAN accommodating device and the center, and between LAN accommodating devices themselves. LAN accommodating devices normally form a star topology with the center at the center, but if communication performance measurements determine that this topology is inappropriate, the monitoring history storage device notifies the management device. Based on the notification, the management device can suggest to the IT administrator that the topology be changed to a loopback type within the LAN accommodating device or a direct connection type between LAN accommodating devices, or can automatically instruct the LAN accommodating devices to do so. Furthermore, if the monitoring history storage device predicts a LAN-related abnormality based on the extensive history information it has collected, it can warn the IT administrator in advance and suggest management operations.

[0035] In this way, the management device is an example of a management device that, in certain cases, makes it possible to propose either return communication within the LAN accommodating device or direct communication between the LAN accommodating devices. Examples of the proposal include displaying on the management console screen a proposal to switch to return communication within the LAN accommodating device or direct communication between the LAN accommodating devices, or sending a message to the network administrator's email address or business chat tool proposing to switch to return communication within the LAN accommodating device or direct communication between the LAN accommodating devices.

[0036] The logical network (for management) is a network that exists at the center, and when a LAN-accommodated device is powered on, it automatically requests a connection and is connected after authentication. This network is also used for periodic re-authentication of the LAN-accommodated device. The LAN-accommodated device is also controlled from the center via this network, and this network is also used for passive authentication of devices originating from the LAN-accommodated device and active authentication of devices and users. Furthermore, all management-related communication traffic other than the communication traffic between devices and other devices, such as information on device communication monitoring and communication performance, is exchanged using this network.

[0037] The logical network (for interconnection) is a network that exists at the center and to which devices are connected after undergoing authentication. Communication traffic between devices and other devices is basically exchanged using this network. The management device at the center defines which devices are permitted to communicate with each other. The LAN accommodating device can discard communications with destinations that are not permitted to communicate according to this definition, preventing them from entering the logical network (for interconnection).

[0038] FIG. 2 is a flowchart illustrating the operation of the connection network system when the power supply of the LAN accommodating device of the present invention is turned on.

[0039] The logical network (for management) connection request in step S001 is a process in which the center receives a connection request to a logical network (for management) existing in the center, which is sent from a LAN accommodating device (for example, a wired LAN router or a wireless LAN router).

[0040] The initial authentication of the LAN accommodating device in step S002 is a process in which the LAN accommodating device is authenticated by the center's authentication function. The center's authentication device (such as the center's management server) verifies whether the authentication information sent from the LAN accommodating device matches the LAN accommodating device's authentication information, such as the LAN accommodating device's hardware identification information, software identification information, sensor information possessed by the LAN accommodating device, and confidential information exchanged when the LAN accommodating device was registered in the management device, which is recorded in an authentication information storage device (such as a hard disk or SSD). The authentication device also references the current registration status, past authentication results stored in a monitoring history storage device (such as a hard disk or SSD), and lockdown history.

[0041] The LAN accommodating device lockdown in step S003 is a process performed when the LAN accommodating device fails the initial authentication process in step S002. The management device terminates the process without connecting the LAN accommodating device to the logical network (for management). The authentication device also transmits and records the lockdown history in the management history storage device. These processes are an example of a lockdown information recording process that records information about devices that could not be connected to the network and / or information about LAN accommodating devices as lockdown information.

[0042] The logical network (for management) connection in step S004 is a process that is performed when the authentication is successful as a result of the initial LAN accommodating device authentication process in step S002. Based on the authentication device authenticating the LAN accommodating device in the process of step S002, the management device connects the LAN accommodating device to the logical network (for management). After that, the LAN accommodating device comes under the control of the management device.

[0043] The start (resumption) of device acceptance in step S005 is a process in which the LAN accommodating device starts or resumes the process of accepting a device connection. After this, when a device is connected to the LAN accommodating device, the operation when a device is connected shown in Figure 3 is executed, which will be described in detail later.

[0044] The communication performance monitoring between the center and other LAN accommodating devices in step S006 is a process for measuring the communication performance between the LAN accommodating device and the center, and the communication performance with other LAN accommodating devices. In this process, the management device performs a process for measuring the communication performance between the center and bases, and the communication performance between bases.

[0045] The sending of various monitoring information in step S007 is a process of sending various monitoring information to the monitoring history storage device. In this process, the management device sends to the monitoring history storage device information on the communication performance with the center and other LAN accommodating devices, and information on the communication traffic of the devices, collected by the LAN accommodating devices.

[0046] The LAN accommodating device periodic re-authentication in step S008 is a process in which the authentication device periodically authenticates the LAN accommodating device. By having the authentication device re-authenticate the LAN accommodating device periodically (for example, hourly, daily, weekly, monthly, or yearly), it becomes possible to detect risks that arise through use and improve security. The difference from the LAN accommodating device initial authentication in step S002 is that even if the authentication does not pass, the LAN accommodating device is not disconnected from the logical network (for management) and authentication is repeated.

[0047] The authentication device periodically re-authenticates the LAN accommodating device. In this embodiment, the authentication device performs re-authentication every few hours, such as every two or three hours, but the re-authentication interval can be changed by setting. If necessary, the re-authentication interval may be another interval, such as every 15 minutes or every hour. Thus, the LAN accommodating device periodic re-authentication is an example of a periodic re-authentication process in which the authentication device periodically re-authenticates the LAN accommodating device.

[0048] The LAN accommodating device lockdown release in step S009 is a process performed when authentication is successful as a result of the LAN accommodating device periodic re-authentication process in step S008. If the LAN accommodating device is marked as an unauthorized device on the management device, the authentication device removes the mark and notifies the IT administrator. Other LAN accommodating devices are also notified of the removal of the mark.

[0049] The LAN accommodating device lockdown in step S010 is a process performed when the LAN accommodating device fails authentication as a result of the LAN accommodating device periodic re-authentication process in step S008. The authentication device marks the LAN accommodating device as an unauthorized device on the management device and notifies the IT administrator of this information. The authentication device also notifies other LAN accommodating devices that it has been marked as unauthorized. The notification method may be any method that can be recognized by the IT administrator, such as displaying the information on a display device, email, or short message.

[0050] The device acceptance stop / disconnection in step S011 is a process in which the LAN accommodating device stops accepting device connections. After this, even if a device is connected to the LAN accommodating device, the center does not execute the operation when a device is connected as shown in Figure 3.

[0051] Disconnecting the logical network in step S012 is a process of disconnecting the logical network. In this process, the management device forcibly disconnects the connection to the logical network at the center or the like that is maintained by the LAN accommodating device marked as unauthorized. Thereafter, connection requests from the LAN accommodating device marked as unauthorized will no longer be accepted by the logical network at the center or the like. This series of processes deletes connections from LAN accommodating devices to which devices that may be subject to unauthorized access may be connected, making it possible to prevent network intrusions by malicious individuals, etc.

[0052] Figure 3 is a flowchart explaining the operation of the network connection system when a device is connected to the LAN accommodating device of the present invention. This operates in parallel with the operation explained in Figure 2. Furthermore, if a new device is connected during operation, the operation already in progress is not terminated, but a different parallel operation is started. In other words, the operation shown in Figure 3 operates in parallel as many times as the number of devices connected to the LAN accommodating device.

[0053] The device setting request response in step S101 is a process for responding to a setting request made by DHCP or the like from a device connected to a LAN accommodating device. The management device's response content is pre-configured, and includes information such as an IP address and routing. When registering the device in the management device, the IP address assigned to the device can be selected to be either a fixed IP address or a unique IP address can be automatically selected when the device is connected.

[0054] The start of device communication monitoring in step S102 is a process of starting to monitor the communication traffic of devices connected to the LAN accommodating device. The management device creates independent logical networks within the LAN accommodating device for each device connected to the LAN accommodating device, and monitors all communication traffic that passes through them.

[0055] The device fingerprint acquisition in step S103 is a process in which the management device acquires device fingerprint information (unique information that identifies the device, passive authentication information) for the device connected to the LAN accommodating device. Examples of fingerprint information include the device's IP address information, MAC address information, available service information, MIB information obtainable by SNMP, HTTPS host key information, SSH host key information, etc.

[0056] Device authentication (passive) in step S104 is a process in which the information acquired by the LAN accommodating device in the device fingerprint acquisition in step S103 is sent to the authentication device as a passive authentication request to perform authentication. The authentication device performs authentication by comparing the passive device authentication information recorded in the monitoring history storage device with the received passive request. Note that by not recording fingerprint information in the LAN accommodating device, security is improved because there is no fingerprint information even if the LAN accommodating device is stolen.

[0057] This network connection system, which includes steps S104 and S105, is an example of a network connection system including a LAN accommodating device that transmits a passive request based on fingerprint information received from an external device to the authentication device, and an authentication device that manages network connection authentication. This process is also an example of a process in which the authentication device receives a passive request transmitted from the LAN accommodating device. The authentication device is also an example of an authentication device that performs a passive authentication process in which the passive request is compared with passive device authentication information recorded in a history storage device to perform authentication. This is an example of a LAN accommodating device that does not record information obtained from devices to transmit to the authentication device.

[0058] The device lockdown in step S105 is a process performed when the device fails authentication as a result of the device authentication (passive) process in step S104. The authentication device marks the device that failed authentication as an unauthorized device on the management device and notifies the IT administrator. The authentication device also notifies other LAN-accommodated devices that the device has been marked as an unauthorized device. The authentication device also sends unauthorized device information to the monitoring history storage device, indicating that the device is an unauthorized device.

[0059] Disconnecting the logical network (continuing communication monitoring) in step S106 is a process in which the management device forcibly disconnects the connection of the device marked as unauthorized to the logical network of the center, etc. Thereafter, the device marked as unauthorized will no longer be able to connect to the logical network of the center, etc.

[0060] The device lockdown is released in step S107 when authentication is successful as a result of the device authentication (passive) process in step S104. If the device is marked as an unauthorized device on the management device, the authentication device removes the mark and notifies the IT administrator. The authentication device also notifies other LAN-accommodating devices that the mark has been removed. In addition to notifying the IT administrator, unauthorized device removal information may be automatically sent to the monitoring history storage device, indicating that the device is not an unauthorized device. In this case, it is possible to reduce the operational costs of network management.

[0061] The logical network (re)connection in step S108 is a process in which the management device connects the device connected to the LAN accommodating device to a logical network such as a center, based on the result of the device authentication (passive) in step S104. After this, the device becomes able to communicate with devices beyond the logical network such as a center. If the management device limits the devices with which the device can communicate, communication traffic other than that to destinations permitted by filtering is discarded and does not flow into the logical network such as a center. This series of processes is an example of a network connection process in which a device connects to a network when connection is possible in the passive authentication process. This series of processes is an example of a traffic filtering process in which the LAN accommodating device performs traffic filtering.

[0062] Step S109 is user / device authentication (active). The center receives and authenticates an authentication request initiated by a user or agent software (e.g., JinCreek (registered trademark)) installed on a device. The authentication device receives active request information, such as an ID and password entered by the user, biometric information, or identification information presented by the agent software. The authentication device then performs authentication by comparing the received active request information with the active device authentication information recorded in the monitoring history storage device. This process is an example of a process in which the authentication device receives an active request sent from a LAN accommodating device when connection is possible in the passive authentication process. This process is an example of an authentication device that performs an active authentication process in which the active request is compared with the active device authentication information recorded in the history storage device to perform authentication.

[0063] Furthermore, the LAN accommodating device periodically re-authenticates the device (steps S104 and S109). In this embodiment, the LAN accommodating device performs re-authentication every few minutes, but the re-authentication interval can be changed by setting. Furthermore, if necessary, the re-authentication interval may be another interval, such as every tens of minutes, such as every 5 minutes, 10 minutes, 20 minutes, or 30 minutes. Thus, steps S104 and S109 are an example of a periodic re-authentication process in which the LAN accommodating device periodically re-authenticates the device.

[0064] Step S110 is a logical network connection update. Based on the result of the user / device authentication (active) in step S109, the management device updates the connection of the logical network, such as the center to which the device is connected. Furthermore, if the devices with which the device can communicate are limited, the management device also updates this information and subsequently filters communication traffic based on that information. Thus, this series of processes is an example of a network connection system that includes a LAN accommodating device that sends passive requests based on fingerprint information received from external devices and active requests from devices or users operating devices, and a management device that manages network connection authentication. Thus, these processes are an example of a network connection process that connects to the network when connection is possible.

[0065] In step S111, the management device checks whether the connection from the LAN accommodating device to the device has been disconnected. If the management device does not receive a signal from a connected device (for example, a PC or printer) for a certain period of time, or if it receives a disconnection signal from the device, it determines that the device has been disconnected from the network.

[0066] Step S112 is the logical network disconnection (communication monitoring end). When the management device detects that the device has been disconnected by the device disconnection? in step S111, the management device disconnects the connection to the logical network of the center or the like connected for the device and ends monitoring of the communication traffic for the device. The management device also deletes the logical network in the LAN accommodating device that was created for the device. Example 2

[0067] 4 is another configuration diagram of a LAN accommodating device of the present invention. When a device connected to a certain LAN accommodating device communicates with another device connected to the same LAN accommodating device, and when it is determined that communication via a logical network (for mutual communication) created in the center is not appropriate due to restrictions on the amount of communication traffic and communication delay, communication between devices is performed by loopback within the LAN accommodating device. The basic operation is the same as in embodiment 1, so a description of the operation will be omitted.

[0068] Logical networks 1-1 and 1-2 are logical networks created within the LAN accommodating device. They exist independently within the LAN accommodating device and are not initially connected to each other. Normally, these logical networks are connected to a logical network such as a center, enabling communication with other devices, but by connecting them within the LAN accommodating device in response to instructions from the management device, mutual communication is possible without connecting to a logical network such as a center.

[0069] As in the second embodiment, when a new device is connected to the LAN accommodating device, the center authenticates the device and manages the connection through the processes of Figures 2 and 3. At the same time, the center connects the logical network within the LAN accommodating device. This makes it possible to perform strict authentication on devices connecting to the network even if there is no IT management expert at the base. Furthermore, since the logical network is connected within the LAN accommodating device after device authentication, communication speeds can be increased compared to communication via the center. Example 3

[0070] 5 is another configuration diagram of a LAN accommodating device of the present invention. When a device connected to a certain LAN accommodating device communicates with a device connected to another LAN accommodating device, and when it is determined that communication via a logical network (for mutual communication) created in the center is not appropriate due to restrictions on the amount of communication traffic and communication delay, communication between the devices is performed by direct communication between the LAN accommodating devices. The basic operation is the same as in Example 1, so a description of the operation will be omitted.

[0071] Logical networks 1-1 and 2-1 are logical networks created within LAN accommodating devices. Normally, these logical networks are connected to a logical network such as a center, enabling communication with other devices, but by interconnecting these between LAN accommodating devices in response to instructions from a management device, mutual communication becomes possible without connecting to a logical network such as a center. LAN accommodating devices are connected to each other via wired communication paths such as optical fiber lines or Ethernet, or wireless communication paths such as Wi-Fi or mesh networks, and multiple logical network connections are accommodated within these paths.

[0072] As in the third embodiment, when a new device is connected to a LAN accommodating device, the center authenticates the device and manages the connection through the processes of FIGS. 2 and 3. Meanwhile, the center connects the logical networks between the LAN accommodating devices at different bases. This makes it possible to perform strict authentication on devices connecting to the network even if there are no IT management experts at the bases. For example, if base 1 is Sapporo, base 2 is Hakodate, base 3 is Asahikawa, and the center's server is located in Fukushima, connecting the logical networks between the bases after authenticating the device can achieve faster communication speeds than communicating via the center.

[0073] According to this invention, IT administrators can manage LANs on a logical network, easily from remote locations using a web browser or similar. Furthermore, many of these management operations can be automated, significantly reducing management costs and even outsourcing the management itself to other specialists. Furthermore, if a LAN-accommodated device selects a cellular communication network as the communication path for communicating with a center or other LAN-accommodated devices, the cellular communication carrier will be responsible for managing that communication path, eliminating the need for an IT administrator. These features free IT administrators from the highly costly task of managing LANs, which significantly contributes to improving the productivity of organizations and companies.

Claims

1. A network connection system including a LAN accommodating device that transmits a passive request based on fingerprint information received from an external device to an authentication device, and an authentication device that manages network connection authentication, a step of receiving the passive request transmitted from the LAN accommodating device by the authentication device; a passive authentication step in which the authentication device compares the passive request with passive device authentication information recorded in a history storage device to perform authentication; a network connection step of connecting to a network if connection is possible in the passive authentication step; A network connection system comprising:

2. A network connection system including a LAN accommodating device that transmits a passive request based on fingerprint information received from an external device and an active request from the device or a user operating the device, and an authentication device that manages network connection authentication, a step of receiving the passive request transmitted from the LAN accommodating device by the authentication device; a passive authentication step in which the authentication device compares the passive request with passive device authentication information recorded in a history storage device to perform authentication; a step of receiving, by the authentication device, the active request transmitted from the LAN accommodating device when connection is possible in the passive authentication step; an active authentication step in which the authentication device compares the active request with active device authentication information recorded in a history storage device to perform authentication; a network connection step of connecting to a network if connection is possible in the active authentication step; A network connection system comprising:

3. 3. The network connection system according to claim 1, wherein: A network connection system characterized in that the authentication device comprises a lockdown information recording step of recording, as lockdown information, the information on the device that could not be connected to the network and / or the information on the LAN-accommodated device.

4. 3. The network connection system according to claim 1, A network connection system comprising a management device that, in a predetermined case, allows for return communication within the LAN accommodating device and / or direct communication between the LAN accommodating devices.

5. 3. The network connection system according to claim 1, A network connection system further comprising a periodic re-authentication step in which the authentication device periodically re-authenticates the LAN accommodating device.

6. 3. The network connection system according to claim 1, A network connection system further comprising a periodic re-authentication step in which the LAN accommodating device periodically re-authenticates the device.

7. 3. The network connection system according to claim 1, The network connection system further comprises a traffic filtering step in which the LAN accommodating device performs traffic filtering.

8. 3. A LAN accommodating device used in the network connection system according to claim 1 or 2, A LAN accommodating device that does not record information obtained from a device to be transmitted to the authentication device.

Images