TW201721498A - Wired area network user management system and method with security and function scalability wherein a network controller is used to control a programmable network switch, and divert a non-authenticated terminal device to an authentication server - Google Patents

Abstract

The present invention provides a wired area network user management system and method with security and function scalability, wherein a network controller is used to control a programmable network switch to divert a non-authenticated terminal device to an authentication server. A webpage is sued to perform authentication, a network load balancer is in charge of the load balancing, the authentication server accesses the back-end database or server for account and password verification, and finally, the authentication server informs the network controller to download the dynamic network open rules to the programmable network switch, so that a terminal device can use the network normally. In addition, the invention can also be used with various network software or hardware to expand other network applications and functions to enable immediate blocking, adjusting or isolating of transmission behaviors with abnormality or adverse effects, thus further enhancing the network security.

Description

Wired area network user management system and method with security and function expansion

The invention relates to a wired area network user management system and method with security and function expansion, in particular to a network controller, a programmable network switch, a server, a network load balancer and The database is a system and method that dynamically authenticates and manages network users and flexibly expands various network functions.

Network security has always been a topic of concern. Early basic network protection mainly blocked illegal connections and external attacks through firewalls, but with the rapid changes of various Trojans and malicious programs, viruses and hackers, it is obvious that It is no longer possible to rely solely on a firewall to maintain network security. At present, most of the wired area networks use Ethernet technology, and plug and play is a feature of the wired Ethernet network. It is easy to use, but it also brings security concerns. If any use As long as the terminal device is connected to the network, the network can be used, and the network security threat brought by malicious users cannot be avoided. Therefore, network user management becomes a focus of improving network security. In order to improve the shortcomings of the traditional Ethernet network, it is possible to control the network users. There are two main technologies and methods to enable the Ethernet network to control the network users, namely 802.1X and DHCP (Dynamic Host). Configuration Protocol).

The 802.1X connection type network access control provides network access control for the second layer of the OSI, and controls the devices connected to the regional network. As far as the network device is concerned, the 802.1X-enabled Ethernet switch must be used in this method. The switch must support the RADIUS (Remote Authentication Dial In User Service) protocol. If the original Ethernet switch does not support it, it must be Software upgrades or updates, if you have been unable to upgrade or update, you must replace the device. As far as user equipment is concerned, the user's computer must also be equipped with 802.1X related software and settings. Otherwise, the entire mechanism cannot operate normally, which is quite inconvenient in actual management and deployment. As far as the network access control method is provided, since only the access control (OSI layer 2) access control can be provided, the use and control restrictions are imposed and inelastic. DHCP only needs to go to the DHCP server to obtain the IP address before accessing the Internet through the user terminal device. The DHCP server can control whether the IP is sent according to the MAC or other methods.

It can be seen that there are still many shortcomings in the above-mentioned methods of use, and there is still room for improvement, which needs to be improved.

In view of the shortcomings derived from the above-mentioned conventional methods, the inventors have improved and innovated, and after years of painstaking research, finally successfully developed a wired area network user management system with security and functional expansion. And methods.

The object of the present invention is to provide a wired area network user management system and method with security and function expansion, and to provide a network controller and a programmable network switch, with server and network load balancing. Systems and methods for network user management, such as devices and databases. Through the system and method, the original network device and the user's computer do not need to be installed. Any software or modify any settings, it is very convenient to use, and in the future can also flexibly expand other network applications and functions, such as OSI first to fourth layer firewall functions, traffic monitoring and management functions. Due to the programmable nature of the programmable network switch, it is also possible to flexibly match various software or hardware to expand other network applications and functions.

A wired area network user management system and method with security and functional scalability that achieves the above objects, using a network controller to control a programmable network switch to transduce unauthenticated users To the authentication server, the authentication server provides a web page for authentication, and the network load balancer distributes the packets to different servers of the same service function, improving service capacity and speeding up service. The authentication server will verify the account and password to the database or server that stores the user account and password. After the verification is passed, the authentication server will notify the network controller to dynamically open the network to the programmable program. The network switch allows users to use the network normally.

In addition, through the features of the programmable network switch, the basic OSI layer 1 to layer 4 firewall functions, traffic monitoring and management functions can be implemented. In the future, various network software or hardware can be used to expand other networks. Applications and features such as deep packet inspection and dynamic protection, traffic analysis and monitoring, and more.

The invention provides a wired area network user management system with security and function expansion, which comprises a main network controller, wherein the main network controller provides a control interface to a terminal device, and queries through the management interface. Adding or deleting a network packet processing rule, a programmable network switch, the programmable network switch is connected to the primary network controller, and processing the packet according to the network packet processing rule An authentication server provides an authentication webpage for the terminal device to authenticate the account and password to a database, and to call the main network control The controller provides the management interface, and downloads the network packet processing rule of the terminal device network to the programmable network switch, and a network load balancer and the authentication server provide a balanced network. Traffic, that is, the packet is sent to the authentication server, wherein the network load balancer is a software or a hard type, and an Ethernet switch connects the terminal device and the programmable network switch. And an Ethernet network, through which the terminal device is connected to the programmable network switch.

It also includes a backup network controller that provides backup for the primary network controller. Among them, through a network software or a hardware, the network controller and the programmable network switch are used to expand and provide other network application functions.

The invention provides a wired area network user management method with security and function expansion, the steps comprising: a programmable network switch connecting a master network controller through a network, the master network controller a preset network packet processing rule is downloaded to the programmable network switch; an end device is directly connected to the programmable network switch through an Ethernet switch or an Ethernet network network, and Transmitting a packet to the programmable network switch, the programmable network switch processing the packet according to the network packet processing rule, and if the terminal device has been authenticated or configured to control the terminal device, The programmable network switch has the network packet processing rule that allows the terminal device to use the network, and the terminal device can normally access the Internet; if the programmable network switch does not allow the terminal device to use the network The network packet processing rule of the path forwards an HTTP Request packet sent by the terminal device to the primary network controller; the primary network controller encapsulates the HTTP Request packet to the The network authentication server and downloaded to the packet processing rules programmable network switch; The terminal device re-issues the HTTP Request packet to the programmable network switch, and the programmable network switch receives the packet transmission processing of the terminal device browser according to the packet processing rule according to the table. Then, the packet is sent to a gateway for routing. After receiving the HTTP Request packet sent by the terminal device, the authentication service of the authentication server returns an HTTP 302 message requesting the terminal device to forward the authentication. An authentication webpage in the server; after receiving an HTTP Reply packet sent back by the transduction service of the authentication server, the programmable network switch is configured according to the network packet processing rule for the authentication server Transmitting service replies to the network packet processing rule of the HTTP Reply packet of the terminal device for transmitting processing, and sends the packet to the terminal device; the terminal device performs the authentication server according to the transduction message of the HTTP Reply 302 packet The authentication webpage in the device sends the HTTP Request packet, wherein the HTTP Request packet of the authentication webpage in the authentication server can pass the process normally. The network switch, after receiving the HTTP Request packet, the authentication webpage in the authentication server returns the HTTP Reply packet of the certificate webpage to the terminal device, and the user inputs an account and a password in the authentication webpage. The authentication server sends the account number and password to a database for verification, and retrieves the verification result; and after the authentication server confirms that the user passes the authentication, the authentication server notifies the primary network controller, the primary network The path controller downloads the network packet processing rule that the terminal device accesses the Internet to the programmable network switch, and also downloads a network opening time parameter to the programmable network switch to control the use. The time when the terminal device uses the network after the network is turned on.

The preset network packet processing rule includes ARP packet processing and permission. The DNS packet passes, forwards the HTTP Request packet to the primary network controller, allows a round-trip to the authentication web page of the authentication server, and knows to control the packet sent by the terminal device.

The packet processing rule of the HTTP request packet sent by the terminal device to the authentication server includes: a. translating the packet processing rule of the HTTP request packet sent by the terminal device to the authentication server, and the packet processing rule is The destination IP address and TCP communication nickname of the packet are modified into a network traffic balancer to represent the TCP communication nickname of the single IP address and transduction service provided by the authentication server, and then the packet is sent to the gateway. And the b. The HTTP server packet processing protocol for the terminal device is modified by the forwarding service of the authentication server to the terminal device, and the source IP address and the TCP communication nickname of the original packet are modified to be the starting packet destination. The IP address is communicated with the TCP communication nickname and then sent to the terminal device.

The packet processing rule that allows the terminal device to access the Internet is configured to allow the terminal device to access the Internet through a combination of a MAC address, an IP address, and an entity connected to any programmable network switch according to actual usage requirements. The network packet processing rule, and the time when the terminal device uses the network after the network is turned on.

100‧‧‧Main network controller

101‧‧‧Backup network controller

102‧‧‧Programmable Network Switch

103‧‧‧Network Load Balancer

104‧‧‧Authentication server

105‧‧‧Database

106‧‧‧Other network software or hardware

107‧‧‧Ethernet Switch

108‧‧‧Ethto Area Network

109‧‧‧ Terminal equipment

S200~S206‧‧‧Step process

FIG. 1 is a schematic structural diagram of a wired area network user management system with security and function expansion according to the present invention.

2 is a flow chart of a method for managing a wired area network user with security and function scalability.

The embodiments of the wired area network user management method with security and function expandability according to the present invention will be described below with reference to the related drawings. For ease of understanding, the same components in the following embodiments are denoted by the same symbols. To illustrate.

Please refer to FIG. 1 , which is a schematic structural diagram of a wired area network user management system with security and function expansion according to the present invention, which includes: a primary network controller 100, which is used for management and control. The stylized network switch 102 queries the related data in the programmable network switch 102, adds and deletes the packet processing in the programmable network switch 102, and provides an external interface to receive the packet processing rules. . The backup network controller 101 is redundant with the primary network controller 100 and functions the same as the primary network controller 100. The programmable network switch 102 is configured to accept the control of the primary network controller 100 or the backup network controller 101, add and delete network packet processing rules in the Table, and provide a primary network controller. 100 or backup data required by the network controller 101. After receiving the packet, the programmable network switch 102 processes the packet according to the network packet processing rule corresponding to the table. When the terminal device 109 is directly or indirectly connected to the programmable network switch 102, it is incorporated into the control of the system. The network load balancer 103 is configured to externally provide a single address of the authentication server 104, and then distribute the network packets to different authentication servers 104 that provide the same service to the backend according to the settings. The authentication server 104 is configured to dynamically forward the HTTP Request sent by the browser of the user terminal device 109 to the authentication webpage, and obtain the account and password input by the user on the authentication webpage to the database 105 for verification. And after the user passes the authentication, notify the main network controller 100 or the backup network controller 101 to open the network packet processing rule of the network to the programmable Network switch 102. Using multiple authentication servers 104 that provide the same service, the network load balancer 103 can be used to select how many authentication servers 104 to use as the amount of service increases or decreases. The database 105 is used for storing user account and password and other related materials to provide the authentication server 104 to verify the account and password input by the user on the authentication webpage, or to use the remote user dial-in authentication service (RADIUS, Remote Authentication Dial). In User Service) to verify the account and password entered by the user. It also provides usage records of the network, such as the IP address (Internet Address Address) of the user terminal device, the MAC Address (Media Address Control Address), the network opening time, and the user's online behavior record. Etc., the use of the network has a record, and this information can provide follow-up tracking, analysis, etc., to facilitate management and improve security. Other network software or hardware 106, through the stylized features of the programmable network switch 102, can be easily and flexibly combined with other network software or hardware to expand network applications and functions in the future. Such as firewall, Intrusion Detection System (IDS), Intrusion Prevention System (IPS), Intrusion Prevention System (IPS), traffic monitoring and analysis, anti-virus and anti-virus. The Ethernet switch 107 is used to collect and access the terminal device 109. The terminal device 109 can be connected to the programmable network switch 102 either directly or indirectly. The Ethernet local area network 108 is used to aggregate and access the terminal device 109, and the Ethernet local area network 108 is finally connected to the programmable network switch 102. The terminal device 109 is used for the user to access the Internet. The terminal device 109 can be connected to the programmable network switch 102 by directly connecting to the programmable network switch 102; indirectly connected to the Ethernet switch 107 or the Ethernet local area network 108. The network switch 102 can be programmed.

Please refer to FIG. 2, which is a flowchart of a method for managing a wired area network user with security and function scalability according to the present invention. The steps include:

S200: The programmable network switch establishes a connection with the primary network controller or the backup network controller;

S201: The primary network controller or the backup network controller sends some preset packet processing rules, such as allowing ARP packets to pass, DNS packets to pass, forwarding the HTTP Request packet to the network controller, and allowing the round-trip authentication server. The packet of the authentication webpage, the packet processing rule that is known to control the packet sent by the user terminal device, etc., to the programmable network switch just connected to the network;

S202: The user terminal device can be connected to the programmable network switch in multiple ways. It can be connected directly to a programmable network switch or directly to a programmable network switch via an Ethernet switch or Ethernet network. The user opens the browser on the terminal device to browse the webpage, and the browser sends a DNS Request. Since the packet processing rule that allows the DNS packet to pass is first down to the programmable network switch in step S201, the DNS packet can pass the programmable program normally. Network switch. Then, after receiving the DNS Request, the DNS Server replies to the DNS Reply, and the browser of the user terminal device sends an HTTP Request after receiving the DNS Reply;

S203: After the programmable network switch receives the HTTP Request packet sent by the user terminal device in step S202, the programmable network switch performs processing according to the packet processing rule in the table, if the user The terminal device has been authenticated or set to control the user terminal device, and the table of the programmable network switch has a packet processing rule that allows the user terminal device to use the network, so the user terminal device can be normal. Go online. Conversely, if the packet processing rule that allows the user terminal device to use the network is not found in the table of the programmable network switch, the HTTP Request packet sent by the user terminal device is forwarded to the primary network controller. Or backup network controller for further processing. Primary network controller or backup network controller The packet processing rule for translating the HTTP packet to the authentication server is down to the programmable network switch, which mainly includes two packet processing rules, which are (1) translating the HTTP Request packet sent by the user terminal device. a packet processing rule to the authentication server, and (2) a packet processing rule of the HTTP reply of the authentication server to the terminal device;

S204: The browser of the terminal device sends an HTTP Request again, and the programmable network switch receives the HTTP Request packet sent by the browser of the terminal device, and then performs the HTTP Request packet processing rule for the terminal device browser according to the table. Packet transmission processing, modifying the destination IP address and TCP communication nickname of the original packet to the TCP communication nickname of the single IP address and transduction service provided by the network load balancer on behalf of the authentication server, and then sending the packet Go to the gateway to route the transmission. After receiving the HTTP Request packet sent by the terminal device browser, the authentication server of the authentication server returns an HTTP 302 message, requesting the browser of the terminal device to forward to the authentication page in the authentication server. After receiving the HTTP Reply packet sent back by the authentication service of the authentication server, the programmable network switch transmits and processes the HTTP Reply packet processing rule for replying to the terminal device according to the authentication server transduction service in the table. The source IP address and TCP communication nickname of the original packet are modified to the IP address and TCP communication nickname of the beginning packet destination, and then sent to the terminal device. The terminal device browser sends an HTTP request to the authentication webpage in the authentication server according to the received HTTP Reply 302 transduction message, and the HTTP packet of the authentication webpage in the round-trip authentication server can normally pass the programmable network switch, and the authentication server is authenticated. After receiving the HTTP Request, the authentication page returns the HTTP Reply to the terminal device browser. The user enters the account and password in the authentication page. The authentication server sends the account and password to the database for verification, and takes the authentication. Back to the verification results.

S205: After the authentication server confirms that the user passes the authentication, the authentication server notifies the main network control Or backup network controller, the primary network controller or the backup network controller will allow the terminal device to access the packet processing rules to the programmable network switch, and also set the network open time under this parameter. To a programmable network switch to control the time that the user terminal device can use the network after the network is turned on;

S206: The user terminal device can normally access the Internet and use the network.

It can be seen that the present invention has achieved the desired effect under the prior art, and is not familiar with the skill of the artist, and its progressiveness and practicability have been met with the patent application requirements.提出 Submit a patent application in accordance with the law, and ask your bureau to approve the application for this invention patent, in order to encourage creation, to the sense of virtue.

The above is intended to be illustrative only and not limiting. Any other equivalent modifications or alterations of the present invention are intended to be included in the scope of the appended claims.

100‧‧‧Main network controller

101‧‧‧Backup network controller

102‧‧‧Programmable Network Switch

103‧‧‧Network Load Balancer

104‧‧‧Authentication server

105‧‧‧Database

106‧‧‧Other network software or hardware

107‧‧‧Ethernet Switch

108‧‧‧Ethto Area Network

109‧‧‧ Terminal equipment

Claims (7)

A wired area network user management system with security and function expansion includes: a primary network controller, the primary network controller provides a control interface to a terminal device, through which the management interface queries and new Adding or deleting a network packet processing rule; a programmable network switch, the programmable network switch is connected to the primary network controller, and processing the packet according to the network packet processing rule; The authentication server provides an authentication webpage for the terminal device to authenticate the account and password to a database, and calls the main network controller to provide the management interface, and processes the network packet of the terminal device network. The rules are downloaded to the programmable network switch; a network load balancer is provided with the authentication server to provide balanced network traffic, that is, the packet is distributed to the authentication server, wherein the network load balancer is Soft or hard; an Ethernet switch that connects the terminal device to the programmable network switch; and an Ethernet network through the Ethernet network , The programmable terminal device and the network switch are connected. The wired area network user management system with security and function expansion as described in claim 1 further includes a backup network controller, which provides backup of the primary network controller. A wired area network user management system with security and function expansion as described in claim 1, wherein the network controller is coupled to the network controller through a network software or a hardware. The network switch expands and provides other network application functions. A method for managing a wired area network user with security and function scalability includes the steps of: a programmable network switch connecting to a main network controller through a network, the main network control Downloading a predetermined network packet processing rule to the programmable network switch; an terminal device is connected to the programmable network switch through an Ethernet switch or an Ethernet network Transmitting a packet to the programmable network switch, the programmable network switch processing the packet according to the network packet processing rule, if the terminal device has been authenticated or is set to be controlled regardless of the terminal device The programmable network switch may allow the terminal device to use the network packet processing rule, and the terminal device can normally access the Internet; if the programmable network switch does not allow the terminal device to use the network The path packet processing rule forwards an HTTP Request packet sent by the terminal device to the primary network controller; the primary network controller encapsulates the HTTP Request packet to an authentication server and downloads the network. Packet processing rules to the programmable network switch; the terminal device resends the HTTP Request packet to the programmable network switch, and the programmable network switch receives the final The device browser performs packet transmission processing according to the packet processing rule in the Table, and then sends the packet to a gateway for routing transmission; the transduction service of the authentication server receives the HTTP Request sent by the terminal device. After the packet is sent back, the HTTP 302 message is sent back, and the terminal device is required to be redirected to an authentication webpage in the authentication server; the programmable network switch returns a message transmitted by the authentication server of the authentication server. After the HTTP reply packet, the network packet processing rule for replying the HTTP reply packet of the terminal device to the authentication server transduction service is processed according to the network packet processing rule, and the packet is sent to the terminal device; The terminal device sends the HTTP Request packet to the authentication webpage in the authentication server according to the forwarding message of the HTTP Reply 302 packet, where the authentication server is sent back and forth to the authentication server. The HTTP Request packet of the authentication webpage can pass through the programmable network switch. After receiving the HTTP Request packet, the authentication webpage in the authentication server returns the HTTP Reply packet of the certificate webpage to the terminal device. The user enters an account number and a password in the authentication webpage, and the authentication server sends the account number and password to a database for verification, and retrieves the verification result; and the authentication server confirms that the user passes the authentication, the authentication The server notifies the primary network controller that the network packet processing rule that allows the terminal device to access the Internet is downloaded to the programmable network switch, and also downloads a network opening time parameter. Go to the programmable network switch to control the time that the user's terminal device uses the network after the network is turned on. The method for managing a wired area network user with security and function expansion as described in claim 4, wherein the preset network packet processing rule includes ARP packet processing, allowing DNS packets to pass, and forwarding the HTTP Request packet. A packet to the primary network controller that allows the authentication web page to be sent back and forth to the authentication server, and is known to control the packet sent by the terminal device. The method for managing a wired area network user with security and function expansion as described in claim 4, wherein the packet processing rule that the terminal device sends the HTTP Request packet to the authentication server includes: c. The packet processing rule for guiding the HTTP request packet sent by the terminal device to the authentication server is to modify the destination IP address and the TCP communication nickname of the original packet to be a network load balancer on behalf of the authentication server. Providing a single IP address and a TCP communication nickname of the transduction service, and then sending the packet to the gateway for routing transmission; and d. the authentication service of the authentication server replies to the HTTP Reply of the terminal device Packet The processing rule is to modify the source IP address and TCP communication nickname of the original packet to the IP address and TCP communication nickname of the starting packet destination, and then send it to the terminal device. The method for managing a wired area network user with security and function expansion as described in claim 4, wherein the packet processing rule for allowing the terminal device to access the Internet is based on the MAC address and IP address according to actual usage requirements. The combination of the entities connected to any of the programmable network switches constitutes the network packet processing rule that allows the terminal device to access the Internet, and can set the terminal to use the network after the network is turned on. time.