Unauthorized device location identification device and location identification method

Abstract

An apparatus and method for efficiently identifying the connection location of unauthorized devices in a large-scale network are provided. [Solution] When a physical address notification sent from an unauthorized device composed of multiple network devices is received, the method involves: obtaining the number of a first connection port from one or more connection ports that corresponds to the physical address of the unauthorized device; obtaining from a first network device that is one of the multiple network devices the number of a second connection port that corresponds to the physical address of another network device; performing a first process to identify one or more other network devices whose second connection port number is the same as the number of the first connection port; performing a second process to obtain from the second network device identified by the first process the number of a third connection port that corresponds to the physical addresses of one or more other network devices connected to the second network device; and repeating the first and second processes to identify the connection location of the unauthorized device.

Description

[Technical Field]

[0001] The present invention relates to a location identification device and a location identification method for identifying the connection location of an unauthorized device connected to devices that constitute a network. [Background technology]

[0002] As a management function, devices that make up a network (e.g., network devices such as switching hubs, L2 switches, and L3 switches) hold information about devices connected to the network (e.g., devices and equipment such as personal computers and printers. An example of such information is FDB (Forwarding Database), which is information that indicates the correspondence between the physical addresses (MAC (Media Access Control) addresses) of devices connected to a network device and the ports (connection port numbers) to which the devices are connected.

[0003] The FDB held by network devices can generally be requested and obtained using the Simple Network Management Protocol (SNMP). SNMP is a protocol for managing and monitoring devices and equipment on a network. To use SNMP, software called an SNMP manager is installed in advance on the management device used by the administrator, and software called an SNMP agent is installed in the devices and equipment on the network (in many cases, network devices and equipment have SNMP agent software built in). The SNMP manager in the management device requests information from the SNMP agent in the network device and monitors its operating status. The SNMP agent notifies the SNMP manager of the information requested by the SNMP manager and the status of the network device. This exchange of information between the SNMP manager and the SNMP agent allows the management device to manage and monitor network devices.

[0004] Because multiple devices, such as other network devices and equipment, are connected to a network device, the FDB, which shows the correspondence between the MAC addresses and connection port numbers of devices connected to the network device, registers the MAC addresses of the multiple connected devices and their corresponding connection port numbers, as described above. To acquire all of the multiple pieces of information in the FDB, the SNMP manager sends a request (command) called a GetNext Request, specified in SNMP, to the SNMP agent. A GetNext Request is a command that requests the next piece of management information (in this example, the FDB) from the SNMP agent. For example, the SNMP manager first sends a GetNext Request to the SNMP agent, requesting the FDB. In response, the SNMP agent returns the first piece of information in the FDB by sending a response (command) called a Get Response, specified in SNMP, to the SNMP manager. Similarly, the SNMP manager sends a GetNext Request to request the next piece of information in the FDB, and the SNMP agent returns the second piece of information in the FDB. By repeating this sequence the number of times equal to the number of pieces of information registered in the FDB, the SNMP manager acquires all of the information in the FDB from the SNMP agent.

[0005] When an SNMP manager obtains specific information from the FDB from an SNMP agent, the SNMP manager sends a request (command) called a Get Request, which is defined in SNMP, to the SNMP agent. A Get Request is a command that requests specific information from specified management information (the FDB in this example) from the SNMP agent. For example, the SNMP manager sends a Get Request requesting connection port number information corresponding to a specific MAC address, and the SNMP agent returns the information corresponding to the specified MAC address via a Get Response. By using the FDB, the management device used by the administrator can identify the connection locations of devices connected to the network.

[0006] For example, Patent Document 1 discloses an apparatus and method for identifying the connection location of an unauthorized device, which is capable of identifying the connection port of a device that is illegally connected to a network device by collecting FDBs and the like from network devices in a network. [Prior art documents] [Patent documents]

[0007] [Patent Document 1] Japanese Patent Application Laid-Open No. 2006-148255 Summary of the Invention [Problem to be solved by the invention]

[0008] In a large-scale network (a network with 1,000 or more connected devices), when a device (hereinafter referred to as an unauthorized device) not approved by the administrator is connected to the network, the location of the unauthorized device can be identified by an SNMP manager in a management device requesting and acquiring all information in the FDB from the SNMP agents in each network device, and then analyzing and processing the contents, as in the prior art described in Patent Document 1. However, in a large-scale network such as the one described above, since numerous network devices and devices are connected to each network device, a large amount of information (the same number as the number of connected devices and devices) is registered in the FDB. If the SNMP manager were to request and acquire all of this information from each SNMP agent as described above, it would need to repeat the above-mentioned sequence of GetNext Request requests and Get Response responses for each piece of information registered in the FDB, which would take a significant amount of time. Each piece of information registered in the FDB is deleted if no data is sent or received from a device, etc., having a MAC address included in that information, within a predetermined period of time known as the aging time. This ensures that the FDB is always kept up to date, but if it takes a long time to obtain the FDB from each network device, the information that you actually want to obtain (connection information for the unauthorized devices mentioned above) may be deleted from each FDB and become impossible to obtain.

[0009] Furthermore, as mentioned above, in a large-scale network, a large amount of information is registered in each FDB, resulting in a large amount of data in each FDB. Therefore, in order to acquire multiple FDBs with such large amounts of data, the management device must be equipped with a memory or storage device with a large storage capacity, and furthermore, it must be equipped with high processing power to analyze and process multiple FDBs with large amounts of data.

[0010] On the other hand, when attempting to identify the connection location of unauthorized devices in a large-scale network using a simple device with lower processing power and smaller memory capacity than a typical personal computer as a management device, due to the limited memory capacity, it is difficult for such a device to acquire all of the information in the FDB from each network device for analysis and processing. Furthermore, even if such a device were to acquire all of the information in each FDB, as mentioned above, there is also the problem that it would take a long time to complete acquisition of all FDBs.

[0011] The present invention has been made in consideration of such problems, and aims to enable efficient identification of the connection location of unauthorized devices in a large-scale network, even using simple devices with low processing power and small memory capacity. [Means for solving the problem]

[0012] The present invention includes multiple means for solving at least part of the above-described problems, and an example thereof is as follows: That is, a location identification device for an unauthorized device connected to a network configured by connecting multiple network devices in multiple stages includes a location identification processing unit, and upon receiving a notification of a physical address sent from the unauthorized device, acquires from each network device a number of a first connection port, among one or more connection ports provided in each network device, that corresponds to the physical address of the unauthorized device, acquires from a first network device that is one of the multiple network devices a number of a second connection port that corresponds to the physical addresses of one or more other network devices connected to the first network device, and performs a first process to identify one or more other network devices having the same second connection port number as the first connection port number, and performs a second process to acquire from a second network device that is one of the one or more other network devices identified by the first process a number of a third connection port that corresponds to the physical addresses of the one or more other network devices connected to the second network device, and identifies the connection location of the unauthorized device by repeating the first and second processes. [Effects of the Invention]

[0013] According to the present invention, even in a large-scale network, it is possible to efficiently identify the connection location of an unauthorized device in a shorter time using a simple device with low processing power and small memory capacity.

[0014] Problems, configurations, and effects other than those described above will become apparent from the following description of the embodiments. [Brief explanation of the drawings]

[0015] [Figure 1] 1 is a block diagram showing an example of the overall configuration of a network in a first embodiment. [Figure 2] 1 is a block diagram showing an example of the configuration of a position specifying device 10 according to a first embodiment. [Figure 3] FIG. 10 is a diagram illustrating an example of a processing procedure for identifying a connection location of an unauthorized device connected to a network in the first embodiment. [Figure 4A] FIG. 2 is a diagram illustrating an example of an FDB held by each SW in the first embodiment. [Figure 4B] FIG. 2 is a diagram illustrating an example of an FDB held by each SW in the first embodiment. [Figure 5A] FIG. 4 is a diagram illustrating an example of SW registration information according to the first embodiment. [Figure 5B] FIG. 4 is a diagram illustrating an example of SW registration information according to the first embodiment. [Figure 6A] 10 is a diagram showing information and flag information acquired from SW by a position identification processing unit 13 in the first embodiment in a table format. FIG. [Figure 6B] 10 is a diagram showing information and flag information acquired from SW by a position identification processing unit 13 in the first embodiment in a table format. FIG. [Figure 6C] 10 is a diagram showing information and flag information acquired from SW by a position identification processing unit 13 in the first embodiment in a table format. FIG. [Figure 6D] 10 is a diagram showing information and flag information acquired from SW by a position identification processing unit 13 in the first embodiment in a table format. FIG. [Figure 6E] 10 is a diagram showing information and flag information acquired from SW by a position identification processing unit 13 in the first embodiment in a table format. FIG. [Figure 7] FIG. 10 is a diagram showing an example of display content of a specified connection position. [Figure 8A] FIG. 4 is a diagram illustrating an example of SW registration information according to the first embodiment. [Figure 8B] FIG. 4 is a diagram illustrating an example of SW registration information according to the first embodiment. [Figure 9A] 10 is a diagram showing information and flag information acquired from SW by a position identification processing unit 13 in the first embodiment in a table format. FIG. [Figure 9B] 10 is a diagram showing information and flag information acquired from SW by a position identification processing unit 13 in the first embodiment in a table format. FIG. [Figure 9C] 10 is a diagram showing information and flag information acquired from SW by a position identification processing unit 13 in the first embodiment in a table format. FIG. [Figure 9D] 10 is a diagram showing information and flag information acquired from SW by a position identification processing unit 13 in the first embodiment in a table format. FIG. [Figure 9E] 10 is a diagram showing information and flag information acquired from SW by a position identification processing unit 13 in the first embodiment in a table format. FIG. DETAILED DESCRIPTION OF THE INVENTION

[0016] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. The embodiment is an example for explaining the present invention, and for clarity of explanation, appropriate omissions and simplifications have been made. The present invention can be implemented in various other forms. Unless otherwise specified, each component may be singular or plural.

[0017] The position, size, shape, range, etc. of each component shown in the drawings may not represent the actual position, size, shape, range, etc. in order to facilitate understanding of the invention. Therefore, the present invention is not necessarily limited to the position, size, shape, range, etc. disclosed in the drawings. When there are multiple components having the same or similar functions, they may be described using the same reference numeral with different subscripts. Furthermore, when it is not necessary to distinguish between these multiple components, the subscripts may be omitted in the description.

[0018] In the embodiments, there may be a description of processing performed by executing a program. Here, a computer executes the program using a processor (e.g., a CPU or a GPU), and performs processing defined by the program while using storage resources (e.g., a memory) and interface devices (e.g., a communication port). Therefore, the entity that executes the program and performs the processing may be the processor. Similarly, the entity that executes the program and performs the processing may be a controller, device, system, computer, or node that has a processor.

[0019] The processing performed by executing the program may be performed by a computing unit, and may include a dedicated circuit for performing specific processing. Here, the dedicated circuit may be, for example, a Field Programmable Gate Array (FPGA), an Application Specific Integrated Circuit (ASIC), or a Complex Programmable Logic Device (CPLD).

[0020] A program may be installed on a computer from a program source. The program source may be, for example, a program distribution server or a computer-readable storage medium. When the program source is a program distribution server, the program distribution server may include a processor and storage resources for storing the program to be distributed, and the processor of the program distribution server may distribute the program to be distributed to other computers. In addition, in an embodiment, two or more programs may be realized as one program, or one program may be realized as two or more programs. [Example]

[0021] 1 is a block diagram showing an example of the overall configuration of a network in the first embodiment. In this embodiment, the network is configured by a plurality of switching hubs (hereinafter referred to as SW) as network devices.

[0022] In Fig. 1, a network is configured with six SWs (SW1 to SW6). Each SW has multiple connection ports (P1 to P3 in Fig. 1) and is connected to other SWs or devices or equipment such as personal computers and printers via LAN (Local Area Network) cables connected to these connection ports. In Fig. 1, SW2 is connected to connection port P1 of SW1 via connection port P2 of SW2, SW3 is connected to connection port P1 of SW2 via connection port P2 of SW3, SW4 is connected to connection port P3 of SW3 via connection port P1 of SW4, SW5 is connected to connection port P2 of SW4 via connection port P1 of SW5, and SW6 is connected to connection port P3 of SW5 via connection port P1 of SW6. In addition, a device (hereinafter referred to as a location identification device or NM) 10 that identifies the connection location of devices connected to the network is connected to connection port P1 of SW3.

[0023] FIG. 2 is a block diagram showing an example of the configuration of the positioning device 10. In FIG. 2, the positioning device 10 includes a processing unit 11 and a communication unit 12. The communication unit 12 is connected to an external device (such as a software) and is an interface for communicating with the external device. The processing unit 11 includes a positioning processing unit 13, a software registration information storage unit 14, an input / output unit 15, an IP communication unit 16, and an ARP table storage unit 17. The positioning processing unit 13 performs a process for identifying the connection positions of devices connected to the network, as described below. The software registration information storage unit 14 stores and holds information about each software that constitutes the network. The input / output unit 15 is used to input information to the processing unit 11 from an input / output device, such as a keyboard, connected to the positioning device 10, and to output information from the processing unit 11 to a display. The IP communication unit 16 is used to communicate with external devices using IP (Internet Protocol) addresses, and the ARP table storage unit stores information indicating the correspondence between the IP address and MAC address of the communication destination, which is referenced and used by the IP communication unit 16.

[0024] In this embodiment, the location identification device 10 is a simple device with performance comparable to that of software, but with lower processing power and less memory capacity than a typical personal computer. One implementation example of the location identification device 10 is a system-on-chip configuration. In this implementation example, the processing unit 11 is a single semiconductor chip, and a central processing unit and memory are incorporated within the semiconductor chip. The location identification processing unit 13, input / output unit 15, and IP communication unit 16 in the processing unit 11, which is a single semiconductor chip, operate according to programs incorporated into the semiconductor chip. The software registration information storage unit 14 and ARP table storage unit 17 are stored in memory within the semiconductor chip. In this implementation example, the central processing unit is a single-core unit operating at a clock speed of several hundred MHz, and the memory is approximately 32 MBytes.

[0025] Furthermore, the processing unit 11 of the location identification device 10 is pre-installed with SNMP manager software, while each SW is pre-installed with SNMP agent software. The location identification processing unit 13 uses SNMP to identify the connection location of a device connected to the network. FIG. 3 is a diagram showing an example of the processing procedure for the location identification processing unit 13 to identify the connection location of an unauthorized device connected to the network (hereinafter referred to as the location identification process). As a premise for this location identification process, an unauthorized device 20 is connected to the connection port P2 of SW5 in FIG. 1. The unauthorized device 20 is, for example, a personal computer owned by an individual, the connection of which has not been approved by the administrator of the network shown in FIG. 1. When connected to SW5, the unauthorized device 20 broadcasts data including its own MAC address "00:11:22:33:44:AA" to initiate communication. The data broadcast by the unauthorized device 20 is received by each SW and the location identification device 10.

[0026] When each SW receives this data, it uses its automatic learning function to register the data reception port number and the MAC address contained in the data in association with each other in the FDB held by each SW. FIG. 4A is a diagram showing an example of the FDB held by each SW, illustrating the state of the FDB when data broadcast from the unauthorized device 20 is received. In FIG. 4A, (a) to (f) correspond to the FDBs of SW1 to SW6, respectively. For example, SW5 receives data directly from the unauthorized device 20 connected to the connection port P2, so as shown in FIG. 4A(e), the connection port P2, which is the data reception port number, and the MAC address of the unauthorized device 20 are registered in association with each other in the FDB of SW5. Furthermore, SW3 receives data via the connection port P3 via SW5 and SW4, so as shown in FIG. 4A(c), the connection port P3, which is the data reception port number, and the MAC address of the unauthorized device 20 are registered in association with each other in the FDB of SW3. The same applies to the other SWs. For ease of explanation, FIG. 4A shows an example of an FDB when an unauthorized device 20 is connected in a state where no information is registered in each FDB (in the initial stage after the network is configured).

[0027] Returning to FIG. 3, the location identification process will be described. In S101, the location identification device 10 receives data broadcast from the unauthorized device 20 via the communication unit 12. The location identification processing unit 13 detects that a new device has been connected to the network by receiving this data. At this time, the location identification processing unit 13 may, for example, store a group of MAC addresses of devices whose connections have been approved in advance by the administrator, and compare the MAC addresses to detect that the newly connected device is an unauthorized device. Alternatively, upon detecting a newly connected device, the location identification processing unit 13 may display the MAC address of the connected device on a display or the like using the input / output unit 15 shown in FIG. 2, and the administrator may determine whether the device is an unauthorized device based on the displayed MAC address. The location identification processing unit 13 starts the location identification process based on the above detection results.

[0028] As described above, the processing unit 11 of the location identification device 10 stores information about each SW constituting the network in the SW registration information storage unit 14. FIG. 5A is a diagram showing an example of SW registration information stored in the SW registration information storage unit 14. In FIG. 5A, at least the name, IP address, and MAC address of each SW are registered in association with each other in the SW registration information. Other information, such as a community name representing a group of devices to be managed, is also registered as SW registration information. For ease of explanation, FIG. 5A shows an example of SW registration information at the time when the location identification processing unit 13 first starts the location identification process. At this time, the names and IP addresses of each SW that the SNMP manager in the processing unit 11 has previously identified as part of the network configuration using SNMP are registered.

[0029] Returning to FIG. 3, in S102, the location identification processing unit 13 uses the IP communication unit 16 to send a Get Request to all SWs, requesting connection port number information corresponding to the MAC address “00:11:22:33:44:AA” of the unauthorized device 20, based on the SW registration information shown in FIG. 5A.

[0030] Each SW receives the Get Request and transmits (responds to) the connection port number corresponding to the MAC address of the unauthorized device 20 by a Get Response to the location identification device 10. At this time, each SW uses its automatic learning function to register in the FDB the receiving port number of the Get Request and the MAC address "00:11:22:33:44:NM" of the location identification device 10 in association with each other, and also registers the receiving port number when a Get Response is received (passed) from another SW in association with the MAC address of the source SW.

[0031] 4B, like FIG. 4A, is a diagram showing an example of the FDB held by each SW, and shows the state of the FDB of each SW in which the information has been additionally registered as described above as a result of the location identification processing unit 13 executing the process of S102. In FIG. 4B, (a) to (f) correspond to the FDBs of SW1 to SW6, respectively. For example, SW3 receives a Get Request directly from the location identification device 10 connected to connection port P1, and further receives Get Responses from all other SWs via connection port P2 or P3 and transmits (relays) them to the location identification device 10. Therefore, as shown in FIG. 4B(c), the FDB of SW3 additionally registers the connection port P1, which is the receiving port number of the Get Request, and the MAC address of the location identification device 10, and the connection port numbers, which are the receiving port numbers of the Get Responses from all other SWs, and the MAC addresses of all other SWs, in association with each other. Furthermore, since SW5 receives a Get Request at connection port P1 via SW3 and SW4 and receives a Get Response from SW6 at connection port P3, as shown in Fig. 4B(e), connection port P1, which is the receiving port number of the Get Request, and the MAC address of position determination device 10, and connection port P3, which is the receiving port of the Get Response from SW6, and the MAC address of SW6 are associated and additionally registered in the FDB of SW5. The same applies to the other SWs.

[0032] As described above, Fig. 4A shows an example of an FDB in which unauthorized device 20 is connected when no information is registered in each FDB (either in the initial stage when the network is configured, or in a state in which a sufficient amount of time (aging time) has passed since communication passed through each SW during network operation), but after location identification device 10 has completed the location identification process at least once, or immediately after network operation has started and communication has passed through each SW, the FDB of each SW will be in a state in which information about connected devices is registered similar to or greater than the state shown in Fig. 4B. Therefore, for each SW whose FDB state is like this, location identification processing unit 13 will execute location identification processing.

[0033] Returning to FIG. 3 , in S103, the location determination processing unit 13 registers the MAC address of each SW in the SW registration information storage unit 14. For example, when the location determination processing unit 13 sends a Get Request to each SW using the IP communication unit 16 in S102, it registers the MAC address of each SW in the SW registration information storage unit 14 using information stored in the ARP table storage unit 17. Similar to FIG. 5A , FIG. 5B is a diagram showing an example of SW registration information stored in the SW registration information storage unit 14, and illustrates the state of the SW registration information in which the MAC address has been added to the name and IP address of each SW as a result of the location determination processing unit 13 executing the process of S103. Note that once the process of S103 is executed, the MAC address of each SW is stored in the SW registration information storage unit 14, and therefore the location determination processing unit 13 does not need to repeatedly execute S103 in subsequent location determination processes.

[0034] By executing the process of S102, the location identification processing unit 13 acquires, from each SW, a connection port number corresponding to the MAC address of the unauthorized device 20. FIGS. 6A to 6E are diagrams showing, in table format, information and flag information required for processing acquired by the location identification processing unit 13 from each or specific SW by executing the processes from S102 onwards. The location identification processing unit 13 does not necessarily store the acquired information and flag information required for processing in memory in such table format, but for ease of explanation, FIGS. 6A to 6E show the acquired information and flag information required for processing organized in table format. In the tables shown in FIGS. 6A to 6E, the vertical axis indicates the name of each SW, and the horizontal axis indicates the information acquired by the location identification processing unit 13, i.e., the connection port number corresponding to the MAC address of the unauthorized device 20 or each SW, and the "candidate flag" and "completion flag" information required for processing.

[0035] First, Fig. 6A shows the connection port numbers corresponding to the MAC addresses of the unauthorized device 20, which the location identification processing unit 13 acquired from each SW by executing the process of S102 above. In Fig. 6A, "MAC AA" in the first row and third column of the table indicates the MAC address of the unauthorized device 20, and the second row and subsequent rows indicate the connection port numbers of each SW corresponding to that MAC address. These connection port numbers correspond to the information in the FDB of each SW shown in Figs. 4A and 4B.

[0036] Returning to Fig. 3, in S104, the location identification processing unit 13 sets SW3, to which the location identification device 10 is connected, as the root, and sets the candidate flag for SW3, which is the root (in Fig. 6A, the candidate flag corresponding to SW3 in the fourth row of the table is changed from No to Yes). Next, similar to S102, the location identification processing unit 13 requests connection port number information corresponding to the MAC address of each SW from the root. Since the FDB held by SW3, which is the root, is in the state shown in Fig. 4B(c), SW3 responds to this request to the location identification device 10 with the connection port numbers corresponding to the MAC addresses of all other SWs.

[0037] 6B shows the connection port numbers corresponding to the MAC addresses of the switches other than the root that the location identification processing unit 13 has acquired from the root by executing the process of S104. "MAC SW1" to "MAC SW6" from the fourth column onwards in the first row of the table indicate the MAC addresses of the switches, and the fourth row (the row relating to SW3) shows the connection port numbers corresponding to these MAC addresses. In S104, when the location identification processing unit 13 has completed acquiring the connection port number information from the root, it sets a completion flag (changes the completion flag corresponding to SW3 in the fourth row of the table in FIG. 6B from No to Yes).

[0038] In S105, the location identification processing unit 13 determines whether or not any of the connection port numbers corresponding to the MAC addresses of the SWs acquired from the root is the same as the connection port number corresponding to the MAC address of the unauthorized device 20. In Fig. 6B, the connection port number of SW3 corresponding to the MAC address "MAC AA" of the unauthorized device 20 is P3, which means that the unauthorized device 20 is connected to the connection port P3 in SW3. Therefore, the location identification processing unit 13 determines that there are SW4 to SW6 whose connection port number corresponding to the MAC address is P3, that is, SW3 which is connected to the same connection port P3 as the unauthorized device 20. Based on the above determination result in S105, the location identification processing unit 13 proceeds to the process of S106.

[0039] In S106, the candidate flags are set for SW4 to SW6 that are determined in S105 to be connected to the same connection port P3 as the unauthorized device 20. Fig. 6C shows the state after the location identification processing unit 13 executes the process of S106, and by setting the candidate flags for SW4 to SW6, the candidate flags corresponding to SW4 to SW6 in the fifth to seventh rows of the table are changed from No to Yes.

[0040] In S107, the position identification processing unit 13 determines whether there is a switch for which the candidate flag is set and the completion flag is not set. In Fig. 6C, there are three switches, SW4 to SW6, that meet the condition (the candidate flag is Yes and the completion flag is No), so the position identification processing unit 13 determines that there are switches SW4 to SW6, and proceeds to the process of S108.

[0041] In S108, the location determination processing unit 13 requests connection port number information corresponding to all SWs for which the candidate flag is set and the MAC address of the location determination device 10 from one of the SWs determined to match the condition in S107. As described above, in FIG. 6C, the SWs that match the condition are SW4 to SW6. Also, in FIG. 6C, the candidate flags are set to Yes for SW3 to SW6. Therefore, the location determination processing unit 13 requests connection port number information corresponding to SW3 to SW6 and the MAC address of the location determination device 10 from SW4, one of the SWs that match the condition. Since the FDB held by SW4 is in the state shown in FIG. 4B(d), SW4 responds to this request by sending the connection port numbers corresponding to SW5, SW6, and the MAC address of the location determination device 10 to the location determination device 10.

[0042] 6D shows the connection port numbers corresponding to SW5, SW6, and the MAC address of the position identification device 10 that the position identification processing unit 13 has acquired from SW4 by executing the process of S108. The fifth row of the table (the row related to SW4) shows these connection port numbers. In S108, when the position identification processing unit 13 has completed acquiring the connection port number information from SW4, it sets a completion flag (changes the completion flag corresponding to SW4 in the fifth row of the table in FIG. 6D from No to Yes).

[0043] When the process of S108 is completed, the location identification processing unit 13 repeats the processes from S105 onwards. In Fig. 6D, among the connection port numbers acquired from SW4, the connection port P2 corresponding to the MAC addresses of SW5 and SW6 is the same as the connection port P2 corresponding to the MAC address of the unauthorized device 20. Therefore, in S105, the location identification processing unit 13 determines that SW5 and SW6 are connected to the connection port P2 of SW4, just like the unauthorized device 20.

[0044] In S106, since the candidate flags for SW5 and SW6 have already been set, the process proceeds to S107. In S107, since SW5 and SW6 meet the conditions as shown in FIG. 6D, the location determination processing unit 13 determines that SW5 and SW6 are present. In S108, among the SWs that meet the conditions in S107, SW5 is requested to provide SW6, for which the candidate flag has been set but the completion flag has not been set, and connection port number information corresponding to the MAC address of the location determination device 10. Since the FDB held by SW5 is in the state shown in FIG. 4B(e), in response to this request, SW5 responds to the location determination device 10 with the connection port number corresponding to SW6 and the MAC address of the location determination device 10.

[0045] 6E shows the connection port numbers corresponding to the MAC addresses of SW6 and position identification device 10 that position identification processing unit 13 has acquired from SW5 by executing the process of S108. The sixth row of the table (the row related to SW5) shows these connection port numbers. In S108, when the acquisition of connection port number information from SW5 is completed, position identification processing unit 13 sets a completion flag (changes the completion flag corresponding to SW5 in the sixth row of the table in FIG. 6E from No to Yes).

[0046] 6E, among the connection port numbers acquired from SW5, there is no connection port P2 that corresponds to the MAC address of the unauthorized device 20, so the location identification processing unit 13 determines that there is no corresponding SW. This determination result indicates that the unauthorized device 20 is connected to connection port P2 of SW5, and the location identification processing unit 13 completes the location identification process in S109. Then, in S110, the location identification processing unit 13 uses the input / output unit 15 to display on a display or the like the connection position in the network of the unauthorized device 20 identified by the location identification process, i.e., the fact that the unauthorized device 20 is connected to connection port P2 of SW5.

[0047] FIG. 7 is a diagram showing an example of the display content of a specified connection location. In FIG. 7, the "Type" column indicates whether the device has been approved for connection by the administrator. For example, "Permitted" is displayed for approved devices, and "Blocked" is displayed for unauthorized devices. The "MAC Address" column displays the MAC address of the connected device. The "Location" column displays the specified connection location. For example, the result of the location identification process in the first embodiment is shown in row No. 1 in FIG. 7. The "Location" column, which indicates the specified connection location, indicates that the unauthorized device 20 is connected to connection port P2 of SW5. Specifically, the first "AA" is a symbol indicating the unauthorized device 20, the next "-SW5" indicates the SW5 to which the unauthorized device 20 is connected, the next ":Port2" indicates the connection port number P2 to which the unauthorized device 20 is connected, and the final "(Found Exactoly)" indicates that the location identification process has been completed and the location has been identified. This display allows the administrator to know the connection location of the unauthorized device 20.

[0048] As described above, in the location identification process by the location identification device in the first embodiment, it is possible to identify the connection location of an unauthorized device connected to a network without acquiring all of the information in the FDB from each network device that makes up the network. As a result, even if a simple device with lower processing power and memory capacity than a general personal computer is used as the location identification device, it is possible to identify the connection location of an unauthorized device. Furthermore, by not acquiring all of the information in the FDB of each network device, it is possible to reduce the time required to identify the connection location and efficiently identify the connection location of an unauthorized device. [Example]

[0049] In the first embodiment, an example was described in which each SW constituting a network has SNMP agent software built in, and each SW can respond to various requests using SNMP from the location determination device 10. However, there may be cases in which part of a network is made up of SW that does not have SNMP agent software built in and does not respond to requests from an SNMP manager (hereinafter referred to as non-intelligent SW). In the second embodiment, an example is described in which part of a network is made up of such non-intelligent SW, and further, the location determination device 10 executes location determination processing for unauthorized devices connected to the non-intelligent SW.

[0050] The network configuration in the second embodiment is assumed to be the same as that shown in FIG. 1. However, in the second embodiment, SW5 in FIG. 1 is assumed to be the non-intelligent SW described above. Naturally, the non-intelligent SW maintains an FDB and relays data, etc., just like other SWs, except that it does not respond to requests from an SNMP manager. Furthermore, the configuration of the location identification device 10 and the processing procedure for location identification processing in the second embodiment are assumed to be the same as those shown in FIGS. 2 and 3. In the following explanation, explanations of the same configuration as in the first embodiment will be omitted, and differences will be explained.

[0051] First, as in the first embodiment, an unauthorized device 20 connects to the connection port P2 of SW5 and broadcasts data including its own MAC address "00:11:22:33:44:AA." The subsequent automatic learning of the FDB related to the unauthorized device 20 by each SW and the detection of connected devices by the locating device 10 in S101 are similar to those in the first embodiment. Also, as in the first embodiment, the processing unit 11 stores information about the SWs constituting the network in the SW registration information storage unit 14, but the contents are different from those shown in FIGS. 5A and 5B. FIGS. 8A and 8B are diagrams showing an example of SW registration information stored in the SW registration information storage unit 14 in the second embodiment. The registration information items are similar to those in FIGS. 5A and 5B, but information about SW5, a non-intelligent SW, is not registered in FIGS. 8A and 8B. This is because the SNMP manager in the processing unit 11 cannot grasp the existence or information of SW5. As with Figure 5A, Figure 8A shows an example of SW registration information at the time when the location identification processing unit 13 starts the location identification processing for the first time, and Figure 8B shows an example of SW registration information after the location identification processing unit 13 performs the processing of S103.

[0052] 3, the location identification processing unit 13 requests SW1 to SW4 and SW6 for connection port number information corresponding to the MAC address "00:11:22:33:44:AA" of the unauthorized device 20, based on the SW registration information shown in Fig. 8A. Each SW that receives this request responds with the connection port number corresponding to the MAC address of the unauthorized device 20. Note that the automatic learning of the FDB by each SW at this time is also the same as in the first embodiment, and therefore the contents of the FDB held by each SW are the same as those shown in Figs. 4A and 4B.

[0053] 9A to 9E are diagrams showing, in table form, information acquired by the location identification processing unit 13 from each or a specific SW by executing the processing from S102 onwards, similar to FIGS. 6A to 6E in the first embodiment. FIG. 9A shows the connection port numbers corresponding to the MAC addresses of the unauthorized devices 20 acquired by the location identification processing unit 13 from each SW by executing the processing from S102 onwards, and is substantially the same as the content of FIG. 6A. However, as described above, information about SW5 to which the location identification processing unit 13 has not sent a request is not shown in this table. In this way, the processing content from S102 onwards and the information acquired by the location identification processing unit 13 by executing the processing are the same, except that the location identification processing unit 13 does not know SW5 and does not make a request or acquire information.

[0054] The position determination processing unit 13 executes S103 to S108 in FIG. 3, as in the first embodiment. By executing the processes up to S108, the information and flag information acquired by the position determination processing unit 13 become as shown in FIG. 9D. Thereafter, the position determination processing unit 13 repeats the processes from S105 onwards. In the first embodiment, the position determination processing unit 13 executed the processes from S105 to S108 for SW5 and SW6 from the second time onwards, but in the second embodiment, the position determination processing unit 13 executes the processes for only SW6. As a result of repeating the processes from S105 to S108 in this way, the information and flag information acquired by the position determination processing unit 13 become as shown in FIG. 9E. Then, the position determination processing unit 13 executes the processes from S105 onwards again. However, in the third execution of S107, as shown in FIG. 9E, there are no SWs for which the candidate flag is set and the completion flag is not set, so the position determination processing unit 13 determines that there is no corresponding SW.

[0055] As a result of this determination, the connection location of the unauthorized device 20 has not been identified, and in S111, the location identification processing unit 13 concludes that location identification is incomplete and terminates the location identification process. Then, in S112, the location identification processing unit 13 displays the connection port P1 of SW6, for which information was last obtained, as the approximate connection location of the unauthorized device 20 on a display or the like using the input / output unit 15. The location identification process result in the second embodiment is shown in row No. 2 in FIG. 7, and the "Location" column displays "AA" indicating the unauthorized device 20, "-SW6" indicating SW6 to which the unauthorized device 20 is assumed to be connected, ":Port1" indicating the connection port P1 to which the unauthorized device 20 is assumed to be connected, and finally "(Found Approximately)" indicating the approximate connection location. This display enables the administrator to know that location identification is incomplete and the approximate connection location of the unauthorized device 20.

[0056] In the second embodiment, a case where a device is connected to a non-intelligent SW has been described, but a non-intelligent SW may exist between the location determination device 10 and the SW to which the device is connected. In this case, the location determination device 10 cannot detect the existence of the non-intelligent SW between them, but it can receive a response from the SW to which the device is connected. Therefore, it is possible to determine the connection location of the device by performing the same location determination process as in the first embodiment.

[0057] As described above, in the location identification process of the second embodiment, in addition to the same effects as those of the first embodiment, even if an unauthorized device is connected to a non-intelligent SW, it is possible to identify the approximate connection location of the unauthorized device and present it to the administrator, even if the location identification is not yet complete. [Example]

[0058] In SNMP, in addition to Get Request and GetNext Request, etc., which are used by an SNMP manager to request information from an SNMP agent, a mechanism (command) called SNMP Trap is defined, which is used by an SNMP agent to spontaneously notify an SNMP manager. The SNMP agent is configured in advance with the circumstances and content for which an SNMP Trap is to be sent, and one example of this is to set the SNMP agent in a network device to send an SNMP Trap when a new device is connected to the network device. In the third embodiment, an example will be described in which the location determining device 10 executes the location determining process by utilizing such a notification of a new device connection via an SNMP Trap.

[0059] In the third embodiment, the network configuration, the configuration of the position identification device 10, the position identification processing procedure, the contents of the FDB held by each SW, and the contents of the SW registration information stored in the SW registration information storage unit 14 are all the same as those shown in Figures 1 to 5B in the first embodiment. However, it is assumed that SW1 to SW6 are set in advance to send an SNMP Trap when a new device is connected.

[0060] In the following explanation, the same configuration as in the first embodiment will be omitted and only the differences will be explained. First, as in the first embodiment, when an unauthorized device 20 is connected to the connection port P2 of SW5, SW5 notifies the location identification device 10 by SNMP Trap that a new device has been connected. The location identification processing unit 13 receives this SNMP Trap and stores in memory the fact that it has received notification of the new device connection from SW5. The subsequent contents from the broadcast of the MAC address from the unauthorized device 20 to the execution of the process of S103 by the location identification processing unit 13 are the same as in the first embodiment.

[0061] In the first embodiment, in the subsequent step S104, the location determination processing unit 13 sets SW3, to which the location determination device 10 is connected, as the root and requests connection port number information corresponding to the MAC address of each SW from the root. However, in the third embodiment, the location determination processing unit 13 remembers that it has received a notification of new device connection from SW5 as described above, and sets SW5, which sent the notification, as the root. Then, the location determination processing unit 13 sets a candidate flag for SW5, which is the root, and requests connection port number information corresponding to the MAC address of each SW from SW5. Since the FDB held by SW5, which is the root, is in the state shown in FIG. 4B(e), SW5 responds to this request by sending the connection port number corresponding to the MAC address of SW6 to the location determination device 10. Upon receiving this response and completing acquisition of connection port number information from the root, the location determination processing unit 13 sets a completion flag for SW5.

[0062] In the next step S105, the location identification processing unit 13 determines whether or not any of the connection port numbers corresponding to the MAC address of each SW acquired from the root is the same as the connection port number corresponding to the MAC address of the unauthorized device 20. However, since the only information acquired from SW5 is that connection port P3 corresponds to the MAC address of SW6, while the connection port number corresponding to the MAC address of the unauthorized device 20 is P2, it is determined that there is no corresponding SW. This determination result indicates that the unauthorized device 20 is connected to connection port P2 of SW5. The subsequent processes of S109 and S110 are the same as those in the first embodiment.

[0063] In the third embodiment, the location identification processing unit 13 designates SW5 as the root because only SW5 notifies the connection of a new device via an SNMP Trap. However, there may be cases where multiple devices are connected to different SWs. For example, if two devices are connected to SW4 and SW5, respectively, SW4 and SW5 each notify the connection of a new device via an SNMP Trap. In such a case, the location identification processing unit 13 may designate, for example, the SW that sent the last notification received before the start of the location identification process as the root during the location identification process. That is, if the order of sending the SNMP Traps is SW4, SW5, then SW5, then SW4, then SW4, then SW5 ...

[0064] As described above, in the location identification process of the third embodiment, in addition to the same effects as those of the first embodiment, by starting to obtain information from a SW to which the unauthorized device to be located is likely to be connected, it is possible to further improve the efficiency of the location identification process and shorten the identification time. [Example]

[0065] Each piece of information registered in the FDB held by each SW is deleted if there is no data transmission or reception from a network device or appliance having the MAC address in that information before the aging time has elapsed. Therefore, when a positioning device executes a positioning process in a large-scale network, there is a possibility that the information requested by the positioning device will be deleted from the FDB of the SW to which the request is made during the process, making it impossible to obtain the information necessary for positioning. In the fourth embodiment, an example of the positioning process in such a case will be described.

[0066] In the fourth embodiment, the network configuration, the configuration of the location identification device 10, the location identification processing procedure, the contents of the FDB held by each SW, and the contents of the SW registration information stored in the SW registration information storage unit 14 are all the same as those shown in Figures 1 to 5B in the first embodiment. In the following explanation, explanations of the same configurations as those in the first embodiment will be omitted, and differences will be explained.

[0067] First, as in the first embodiment, the unauthorized device 20 is connected to the connection port P2 of SW5. The process from the broadcast of the MAC address from the unauthorized device 20 to the execution of the process of S107 by the location identification processing unit 13 is the same as in the first embodiment. As in the first embodiment, in the subsequent S108, the location identification processing unit 13 requests SW4 for connection port number information corresponding to SW3 to SW6 for which the candidate flag is set and the MAC address of the location identification device 10. However, at this point, the aging time for the information on SW5 and SW6 in the FDB of SW4 shown in FIG. 4B(d) has elapsed, and the information has been deleted. In this case, the location identification processing unit 13 cannot obtain the requested information from SW4, i.e., the connection port number information for SW3 to SW6 for which the candidate flag is set. As a result, the location identification processing unit 13 determines that the requested information has not been obtained, and proceeds to the process of S111 as in the second embodiment. As a result, the location identification processing unit 13 determines that the requested information has not been obtained, and proceeds to the process of S111. As a result, the location identification processing unit 13 determines that the connection port P2 of SW4, for which information was last requested, is not completed and displays the connection port P2 of SW4, for which information was last requested, as the approximate connection location of the unauthorized device 20 on a display or the like using the input / output unit 15.

[0068] In the above example, the location determination processing unit 13 terminates the process without completing location determination when it does not receive information from SW4. On the other hand, it is empirically known that the aging time differs for each piece of information registered in the FDB, and that the timing at which information is deleted may also differ depending on the SW. Therefore, the location determination processing unit 13 may not terminate the process when it does not receive information from SW4, but may continue processing for SW5 and SW6 other than SW4, which was determined to match the condition in S107. In this case, after determining that the requested information was not received from SW4, the location determination processing unit 13 subsequently executes the process of S108 for, for example, SW5. If the location determination processing unit 13 receives a response from SW5 with the information shown in the sixth row of the table in FIG. 6E, the location determination processing unit 13 executes the process of S105 as in the first embodiment, and can complete location determination. On the other hand, if it determines that the requested information was not received from SW5, it continues the process of S108 for SW6. If a response is obtained from SW6, similarly to the second embodiment, the processes of S105 to S107 are repeated, and then in S111 the location identification processing unit 13 ends the location identification process as not being completed, and displays the connection port P1 of SW6 on a display or the like using the input / output unit 15 as the approximate connection location of the unauthorized device 20. On the other hand, if it is determined that the requested information has not been obtained from SW6, similarly to the above example, the location identification processing unit 13 displays the connection port P1 of SW6, which last requested information as not being completed, on a display or the like using the input / output unit 15 as the approximate connection location of the unauthorized device 20.

[0069] As described above, in the location identification process of the fourth embodiment, in addition to the same effects as those of the first embodiment, even if the FDB information of the SW that is the target of the request is deleted due to the aging time, it is possible to identify the approximate connection location of the unauthorized device and present it to the administrator, even though the location identification is not complete.

[0070] Although the above describes various embodiments and variations of the present invention, the present invention is not limited to the above-described exemplary embodiments and includes various variations. For example, the above-described exemplary embodiments have been described in detail to facilitate understanding of the present invention, and the present invention is not limited to those including all of the components described herein. Furthermore, it is possible to replace part of the components of one exemplary embodiment with the components of another exemplary embodiment. It is also possible to add the components of another exemplary embodiment to the components of one exemplary embodiment. Furthermore, it is also possible to add, delete, or replace part of the components of each exemplary embodiment with other components. Furthermore, some or all of the above-described components, functions, processing units, processing means, etc. may be implemented in hardware, for example, by designing them as integrated circuits. Furthermore, the control lines and information lines in the figures are only those considered necessary for explanation, and not necessarily all are shown. It is also possible to consider that almost all components are interconnected. [Explanation of symbols]

[0071] 10...Location device 11...Processing section 12. Communications Department 13...Location identification processing unit 14...SW registration information storage section 15…Input / output section 16...IP communication section 17...ARP table storage section 20…Unauthorized device

Claims

1. A location identification device for an unauthorized device connected to a network configured by connecting a plurality of network devices in multiple stages, a location identification processing unit; Upon receiving notification of the physical address of the unauthorized device transmitted from the unauthorized device, the location identification processing unit acquires from each of the network devices a number of a first connection port, among one or more connection ports provided in each of the network devices, that corresponds to the physical address of the unauthorized device, and acquires from a first network device that is one of the plurality of network devices a number of a second connection port that corresponds to the physical addresses of one or more other network devices connected to the first network device, and identifies one or more of the other network devices having the same number of the second connection port as the number of the first connection port; and acquires from a second network device that is one of the one or more other network devices identified by the first process a number of a third connection port that corresponds to the physical addresses of one or more other network devices connected to the second network device, thereby identifying the connection location of the unauthorized device. Locating device.

2. 2. The position determination device according to claim 1, the location identification processing unit sets a candidate flag for the one or more other network devices identified by the first processing to designate the other network devices as candidates for the second processing, and sets a completion flag for the second network device that has completed the second processing among the one or more other network devices for which the candidate flag has been set. Locating device.

3. 3. The position specifying device according to claim 2, the location identification processing unit performs the second process by treating one of the one or more other network devices for which the candidate flag is set and the completion flag is not set as the second network device. Locating device.

4. 3. The position specifying device according to claim 2, the location identification processing unit completes the location identification in the first process if there is no other network device whose second connection port number is the same as the first connection port number; Locating device.

5. 4. The position specifying device according to claim 3, the location identification processing unit does not perform the second process when there is no other network device for which the candidate flag is set and the completion flag is not set, and ends the process without determining that location identification is incomplete. Locating device.

6. 5. The position specifying device according to claim 4, When the location identification processing unit completes the location identification, it outputs the connection location of the identified unauthorized device. Locating device.

7. 6. The position specifying device according to claim 5, When the location identification processing unit terminates the process with the location identification being incomplete, it outputs the number of the connection port of the second network device corresponding to the physical address of the unauthorized device in the final second process as an approximate connection location of the unauthorized device. Locating device.

8. A method for locating an unauthorized device connected to a network in which a plurality of network devices are connected in multiple stages, comprising: Upon receiving a notification of the physical address of the unauthorized device transmitted from the unauthorized device, acquire from each of the network devices a number of a first connection port, among one or more connection ports provided in each of the network devices, that corresponds to the physical address of the unauthorized device; acquiring, from a first network device that is one of the plurality of network devices, a number of a second connection port corresponding to a physical address of one or more other network devices connected to the first network device; execute a first process of identifying one or more of the other network devices having the same number of the second connection port as the number of the first connection port; execute a second process of acquiring, from a second network device that is one of the one or more other network devices identified by the first process, a number of a third connection port corresponding to a physical address of the one or more other network devices connected to the second network device; The first process and the second process are repeated to identify the connection location of the unauthorized device. Location method.

9. 9. The location determination method according to claim 8, setting a candidate flag for one or more of the other network devices identified by the first process to designate them as candidates for the second process; setting a completion flag for the second network device that has completed the second process among the one or more other network devices for which the candidate flag has been set; Location method.

10. 10. The location determination method according to claim 9, performing the second process using one of the one or more other network devices for which the candidate flag is set and the completion flag is not set as the second network device; Location method.

11. 10. The location determination method according to claim 9, In the first process, if there is no other network device whose second connection port number is the same as the first connection port number, completing the location determination. Location method.

12. 11. The location determination method according to claim 10, If the candidate flag is set and there is no other network device for which the completion flag is not set, the second process is not performed, and the process is terminated with the location determination being incomplete. Location method.

13. 12. The location determination method according to claim 11, When the location identification is completed, the connection location of the identified unauthorized device is output. Location method.

14. 13. The location determination method according to claim 12, When the process is terminated with the determination that location identification is incomplete, the number of the connection port of the second network device corresponding to the physical address of the unauthorized device in the final second process is output as an approximate connection location of the unauthorized device. Location method.

Images