JP2003018183A - DNS server data change system and authentication server - Google Patents

Abstract

(57) [Summary] [PROBLEMS] To securely register / delete data in a dynamic DNS server when using an emergency connection service to the Internet. An authentication server checks predetermined information in a message related to billing received from a network access server. If the predetermined information indicates that a user computer starts connection to the Internet, the authentication server checks the information.
Registering data on the computer in the S server,
When the predetermined information indicates that the connection of the user computer to the Internet has been completed, data relating to the computer is deleted from the DNS server.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a technique for changing domain name system (DNS) data on the Internet.

[0002]

2. Description of the Related Art When information is transmitted on the Internet, a computer is installed as an information transmission server, and a URL is disclosed as an address for external access instead of an IP address itself. This URL is composed of the host name, domain name, and file location on the server.

Therefore, when accessing the server, it is necessary to obtain the IP address from the combination of the host name and the domain name. For that purpose, there is a domain name system (DNS) as a service for converting a combination of a host name and a domain name into an IP address.
35.

That is, when accessing the information transmission server by the publicized URL, the DNS is inquired about the combination of the host name and the domain name, the IP address is converted, and the information transmission server is connected by the converted IP address. It will be.

When connecting the information transmission server to the Internet, there is a method of using the constant connection service of the Internet service provider (ISP) and a method of using the emergency connection service equivalent to dial-up. In the constant connection service, the IP address is fixedly assigned to the information transmission server, but in the emergency connection service equivalent to dial-up, the IP address assigned is changed each time the Internet is connected.

Therefore, when the information transmission server is installed using the emergency connection service equivalent to dial-up, I
Every time the IP address given by the SP is changed, that is, every time the information transmission server connects to the Internet, it is necessary to change the combination of the host name and the domain name and the projection of the IP address in the DNS server.

In the prior art, when the host server is added or changed, the data of the DNS server is updated directly by directly editing the data file, or the DNS data specified in RFC2136 is dynamically changed. This is done manually using a tool for accessing the DNS server (dynamic DNS server) by the method.

When the A record of the DNS data is updated by the method specified in RFC2136, the user manually registers the DNS data at the time of connection and the DNS before disconnection.
Data will be deleted. In this case, registration is performed to secure access from the outside when connecting, but data deletion is not always performed due to abrupt stop of the connected computer, abrupt disconnection of the connection line, or forgetting to delete the data. .

[0009]

As described above, when the emergency connection service is used, it is necessary to manually register / delete data with respect to the DNS server, and there is a problem that the deletion is not surely performed. is there.

The present invention has been made in view of the above,
An object of the present invention is to provide a technique that enables automatic and reliable data registration / deletion in a DNS server when using an emergency connection service to the Internet.

[0011]

In order to achieve the above object, the present invention can be configured as follows.

The invention according to claim 1 is a system for changing data of a DNS server when a computer connects to or disconnects from the Internet, and a network access server for accepting a connection request for connecting to the Internet from the computer. And an authentication server that authenticates the computer in response to a request from the network access server that has accepted the connection request, and the authentication server checks predetermined information in a message regarding charging received from the network access server. If the predetermined information indicates that the computer starts connection to the Internet, data regarding the computer is registered in the DNS server, and the predetermined information indicates that the computer has finished connecting to the Internet. DNS server if indicated To delete the data on the computer from.

According to a second aspect of the present invention, in the first aspect, when the predetermined information indicates that the computer starts a connection to the Internet, the authentication server is operated from the message. The computer user name and IP address information are acquired, the host name corresponding to the user name is acquired, the IP address information and the host name are registered in the DNS server, and the predetermined information is
When the computer indicates that the connection with the Internet has been terminated, the user name of the computer is acquired from the message, the host name corresponding to the user name is acquired, and the data corresponding to the host name is acquired from the DNS server. delete.

The invention according to claim 3 is the invention according to claim 1 or 2.
In the above description, the message regarding the charging is Ra
It is an accounting request message in the dius protocol, and the predetermined information is the status type in the accounting request message.

The invention described in claims 4 and 5 is an authentication server suitable for use in the above system.

According to the present invention, the authentication server performs the data registration / deletion processing of the DNS server according to the type of the message regarding the billing received from the network access server, thereby connecting / disconnecting the communication of the user computer.
The disconnection and the data registration / deletion process of the DNS server can be linked. Therefore, there is no need to perform manual DNS data registration as in the past, and the DNS
It becomes possible to reliably delete the server data.

[0017]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described below with reference to the drawings.

FIG. 1 is a diagram showing the configuration of an Internet connection system according to an embodiment of the present invention.

The Internet connection system shown in FIG. 1 has a connecting computer 1, a network access server 2, an authentication server 3, and a DNS server 4.

The connection computer 1 is an information disclosure server or the like that connects to the Internet using the emergency connection service of the Internet service provider, connects to the network access server 2, and connects the network access server 2 after the authentication by the authentication server 3. You will be able to access the internet through. The network access server 2 uses Rad for authentication and accounting.
The authentication server 3 is accessed by the ius protocol. The DNS server 4 has a function of converting a combination of a host name and a domain name into an IP address.

The authentication server 3 has a user management function 31, an authentication function 32, and an accounting function 33, and also has a function of updating the data of the DNS server 4 in the present invention.
The user management function 31 is a function for managing user information such as a user name and password. In the present invention, a host name management function 34 is added to manage a host name for a computer to be connected for each user. The authentication function 32 is a function that, when receiving the authentication request, acquires the information of the corresponding user from the user management function 31 and performs authentication. The accounting function 33 is a function for writing the accounting information to a log when an accounting message is received.

In the present invention, the accounting function 33 has a DNS data registration function 35 and a DNS data deletion function 36.
Is added, and the data of the DNS server 4 is operated.

The Radi used in the authentication server 3
The us protocol is often used for user access authentication, accounting, etc. when connecting to the Internet. The authentication protocol is specified in RFC2865 and the accounting protocol is specified in RFC2866.

Each of the above servers can be realized by installing a program for executing the processing procedure of each server in a computer having a CPU, a memory, a hard disk, an input / output device, a communication control device and the like.

Next, referring to FIG. 1, the operation of the Internet connection system in this embodiment will be described.
The following procedure is based on the Radius protocol, except for the data change of the DNS server.

When the connecting computer 1 tries to connect to the Internet, the connecting computer 1 issues a connection authentication request to the network access server 2 (step 1). Network access server 2 that received the request
Communicates with the authentication server 3 for authentication by the Radius protocol. That is, the access request message is transmitted to the authentication server 3 (step 2).
When the authentication is performed by the authentication server 3, the authentication server 3 sends an access accept message to the network server 2 (step 3). As a result, the connection authentication result is sent to the connecting computer 1 (step 4),
The connected computer 1 can connect to the Internet.

If the authentication is successful, the network access server 2 sends an accounting request message for accounting to the authentication server 3 (step 5), and the authentication server 3 returns an accounting response message (step 6). .

An accounting request message at the time of connection to the Internet records in the authentication server 3 that communication is started. Also, the connection computer 1
If the communication between the network access server 2 and the network access server 2 is cut off for some reason including the end of communication, the network access server 2 sends an accounting request message to the authentication server 3 to notify it of the end of communication. It is recorded in 3 that the communication is completed.

In the present invention, the authentication server 3 registers or deletes the data (A record) of the DNS server 4 triggered by the above accounting request message (steps 7 and 8). This operation will be described in detail according to the procedure of FIG.

FIG. 2 shows the processing sequence of the accounting function, and the part within the dotted line is the operation of the DNS data registration function 35 and the DNS data deletion function 36 in the present invention.

First, when the authentication server 3 receives the accounting request message, it checks the status type in the accounting request message (step 11).

FIG. 3 shows the format of the accounting message. The status type is included in the attribute portion in the figure. Further, the code (4 or 5) identifies whether it is an accounting request or an accounting response.

The status type in the accounting request message indicates that when the connecting computer 1 is connected to the network access server 2, it starts.
(Acct-Status-type = Start) and the connected computer 1
Is disconnected from the network access server 2, the status type is Stop (Acct-Status-type = St
op). FIG. 4 shows an example of attributes output as a log file (example at the time of connection).

Next, the authentication server 3 distributes the processing according to the above status type (step 1 in FIG. 2).
2).

When the status type is start,
The user name and IP address information are acquired from the accounting request message (step 13), the host name corresponding to the user name is acquired from the host name management function 34 of the user management function 31 (step 14), and the IP address information and host are acquired. The name is registered as an A record in the DNS server 4 (step 15).

When the status type is stop,
The user name is acquired from the accounting request message, and the host name corresponding to the user name is acquired from the host name management function 34 of the user management function 31 (step 1
6) The A record corresponding to the host name is deleted from the DNS server 4 (step 17).

FIG. 5 (a) shows a data structure in a normal user management function, and FIG. 5 (b) shows a "host name" in the data structure for adding the host name management function 34 in the present invention. The data structure of the user management function 31 to which is added is shown. By using this host name management function 34, it is possible to obtain the data used when registering the A record shown in FIG. 6A and the data used when deleting the A record shown in FIG. 6B.

FIG. 7 shows a description example of data in the DNS server 4. According to the present invention, when a computer having the host name shown in the figure is connected to the Internet, a record corresponding to the host name is automatically added, and when disconnected, a record corresponding to the host name is automatically added. Will be deleted.

Subsequently, the accounting log is written (step 18), and an accounting response message is sent to the network access server (step 19).

The present invention is not limited to the above embodiments, and various modifications and applications are possible within the scope of the claims. For example, although the case where the Radius protocol is used is shown in the above embodiment, the present invention can be applied to a protocol other than the Radius protocol as long as the protocol uses a message corresponding to the above accounting message. .

[0041]

As described above, according to the present invention,
Since the authentication server using the Radius protocol decides to register / delete data on the DNS server according to the status type of the accounting request message, when the user connects / disconnects the computer to / from the Internet, the data is manually transferred to the dynamic DNS server. There is no need to register / delete. Therefore, the Internet service provider can provide a highly convenient Internet emergency connection service.

Further, since it is possible to interlock with the dynamic DNS according to the line connection state from the network access server, the line disconnection state is generated even when the connection line is suddenly disconnected or the connected computer is suddenly down. As a result, it is possible to automatically perform data deletion processing on the DNS server, and it is possible to prevent data that is not used carelessly from remaining.

[0043]

[Brief description of drawings]

FIG. 1 is a diagram showing a configuration of an internet connection system according to an embodiment of the present invention.

FIG. 2 is a flowchart showing the operation of the Internet connection system according to the embodiment of the present invention.

FIG. 3 is a diagram showing a format of an accounting message.

FIG. 4 is a diagram showing an example of attributes output as a log file (example at the time of connection).

FIG. 5 is a diagram showing a data structure in a user management function.

FIG. 6 is a diagram showing data used when registering or deleting an A record.

FIG. 7 is a diagram showing a description example of data in a DNS server.

[Explanation of symbols]

1 Connected computer 2 Network access server 3 Authentication server 4 DNS server 31 User management function 32 Authentication function 33 Accounting function 34 Host name management function 35 DNS data registration function 36 DNS data deletion function

   ─────────────────────────────────────────────────── ─── Continued front page    (72) Inventor Shinji Mizunuma             14-4 Minami-Asama-cho, Nishi-ku, Yokohama-shi, Kanagawa             Company Ivy Network (72) Inventor Akira Shinoda             223-1, Yamashita-cho, Naka-ku, Yokohama-shi, Kanagawa             NTT Software Corporation F term (reference) 5K030 GA15 HB08 KA05

Claims (5)

[Claims] 1. A system for changing data of a DNS server when a computer connects or disconnects from the Internet, the network access server accepting a connection request for Internet connection from the computer, and the connection request accepted. An authentication server that authenticates the computer in response to a request from the network access server, the authentication server checks predetermined information in a message regarding charging received from the network access server, and the predetermined information is When the computer indicates that the connection to the Internet is to be started, data relating to the computer is registered in the DNS server, and when the predetermined information indicates that the computer has completed the connection to the Internet, the DNS server sends the data. The computer System and deletes the data about. 2. The authentication server obtains the user name and IP address information of the computer from the message when the predetermined information indicates that the computer starts connecting to the Internet, The host name corresponding to the user name is acquired, and the I
The P address information and the host name are registered in the DNS server, and when the predetermined information indicates that the computer has finished connecting to the Internet, the user name of the computer is acquired from the message, and the user The system according to claim 1, wherein a host name corresponding to the name is acquired, and the data corresponding to the host name is deleted from the DNS server. 3. The message regarding the charging is Rad
3. The system according to claim 1, wherein the system is an accounting request message in the ius protocol, and the predetermined information is a status type in the accounting request message. 4. An authentication server for authenticating a computer in a system for changing data of a DNS server when the computer connects to or disconnects from the Internet, wherein predetermined information is included in a message regarding charging received from a network access server. And a means for registering data relating to the computer in the DNS server when the predetermined information indicates that the computer will start connecting to the Internet, and the predetermined information is used for the computer. And a means for deleting data relating to the computer from the DNS server when indicating that the connection has been completed. 5. The registering means obtains a user name and IP address information of the computer from the message when the predetermined information indicates that the computer starts connecting to the Internet, The host name corresponding to the user name is acquired, and the I
The P address information and the host name are registered in the DNS server, and the deleting unit deletes the message from the message when the predetermined information indicates that the computer has finished connecting to the Internet. The authentication server according to claim 4, further comprising means for acquiring a user name of the computer, acquiring a host name corresponding to the user name, and deleting data corresponding to the host name from the DNS server.