JPH1093604A - Switching hub - Google Patents

Abstract

(57) [Problem] To provide a switching hub for improving network security. SOLUTION: Whether or not a terminal is connected to a port is detected, and when the time during which the terminal is not connected exceeds a predetermined time, the port is set to be unusable.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a switching hub capable of simultaneously communicating between a plurality of ports by relaying a frame to a specific port corresponding to a destination address of a received frame, and more particularly to network switching. The present invention relates to a switching hub for improving the quality.

[0002]

2. Description of the Related Art FIG. 4 shows a configuration of a switching hub conforming to the IEEE802.3 CSMA / CD standard defined by the American Institute of Electrical and Electronics Engineers. The switching hub includes a CPU 101, a memory 105, a destination determination unit 106,
The transfer control unit 107 and the communication LSI 1 of each of the ports 1 to n
09 (1091 to 109n) are interconnected via the transfer data bus 108. The CPU 101 controls the entire switching hub. The memory 105
It is used for a reception buffer that stores the entire frame received by the switching hub. The communication control LSI 109
The communication is performed in accordance with the EEE802.3 standard. The destination determining unit 106 determines to which port the received frame is output. Transfer control unit 10
Numeral 7 controls data transfer between the communication control LSIs. Reception FIFO built in communication control LSI 109
Reference numeral 111 (1111 to 111n) temporarily stores the received frame.

The flow of data in a switching system called a store-and-forward system will be described with reference to FIG. 4, and the flow of processing will be described with reference to FIG.
In this method, the switching hub receives frame 2
011 is a FIFO inside the communication LSI 1091
It is stored in the reception 1111. Next, when the CPU 101 releases the transfer data bus 108 and becomes ready for data transfer, the frame 2011 is sent from the communication LSI 1091 to the reception buffer of the memory 105 and stored.
After the entire frame 2011 is stored, the CPU 101
Checks if the stored frame is an error frame. If the frame is abnormal, the frame is discarded. In the case of a normal frame, the CPU 101 extracts the destination address of the frame, and the destination determination unit 106 determines the transfer destination port. Communication LSI of transfer destination port
When data transfer becomes possible, the frame 201 read from the reception buffer of the memory 105
1 is output to port n.

Next, a switching hub for setting whether or not each port can be used will be described. As shown in FIG. 6, the switching hub includes a console control unit 102 for controlling a console 103 and a nonvolatile memory 104 in addition to the configuration of FIG. 4, and an administration state register 110 (built-in to a communication control LSI 109). 1101-1
10n) sets whether the port can be used or not.

Whether or not each port of the switching hub can be used is determined by state setting. The state to be set is called an admin state. If the admin state of an arbitrary port is “on”, that port is available, and if “off”, it is unavailable. When a port becomes unusable, terminals connected to the port cannot communicate with other terminals.

The setting of the administration state of each port is performed by the administration state register 11 in each communication LSI 109.
0 is stored. The setting of this register is normally “on” immediately after the switching hub is initialized. To change this setting, use the setting console 1
This is performed by inputting an administration state change command from 03 to the switching hub. To change the setting, an administration state change command is input from the console 103 to the switching hub. The contents are stored in each of the admin state registers 110 and also written in the nonvolatile memory 104. When resetting or turning on the power (restarting), the data is
The CPU 101 reads and sets each communication LSI 109.

[0007] Inside the destination determining unit 106 of the switching hub of FIGS. 4 and 6, there is an address table in which a source address of a received frame and a port number are associated with each other. A method for determining a destination port using this address table will be described.

First, it is checked whether or not the source address of the received frame has already been registered. If the port number has been registered, it is checked whether the corresponding registered port number matches the port number of the port that received the frame. If not, a new port number is registered. If the address is not registered, the address and the port number are registered. Next, check whether the destination address of the received frame is already registered,
If registered, the frame is output only to the corresponding port. If not registered, the frame is discarded or transferred to all ports.

[0009]

In the switching hub of the prior art, the setting of the admin state is also stored in the non-volatile memory 104. Therefore, even if the power is turned off or restarted by reset, the setting of each port is performed. Can be held. However, in this state, if an unused port is set to “on”, the setting is to be retained, so connect the terminal to the unused port,
It is possible to easily access a terminal or server already connected to another port. Therefore, switching hubs cannot protect against attempts to obtain important information without permission.

[0010] In the destination port determination method using the address table, a new terminal can be connected to the switching hub to easily access a terminal or server already connected to another port. Yes, switching hubs cannot protect against attempts to obtain important information without permission.

An object of the present invention is to provide a switching hub that solves the above-mentioned problems and improves network security.

[0012]

In order to achieve the above object, the present invention has a plurality of ports used for transmitting and receiving a frame, relays a received frame to a port corresponding to a destination, and sets a port for each port. Available or Unavailable
A switching hub that has a non-volatile memory for storing the state variables of the port and sets whether the port can be used or not according to the state variable read from the non-volatile memory at power-on or reset. It detects whether or not the port is connected, and when the time during which the terminal is not connected exceeds a predetermined time, the port is set to be unusable.

[0013] Further, it has an address table which has a plurality of ports and registers the addresses of the connected terminals in correspondence with the ports. The address table is searched by the destination address of the frame and the frame is relayed to the corresponding port. In the switching hub, the address of the terminal connected to each port is registered in the address table in advance, and even if a frame whose source address is unregistered is received, new registration in the address table is performed. Is not performed, and the frame is discarded.

When a frame whose source address is unregistered is received, new registration is not performed, and the frame is discarded, and a new registration is performed with the source address corresponding to the port, and the frame is relayed. And the mode in which it is performed may be selectable.

[0015]

An embodiment of the present invention will be described below in detail with reference to the accompanying drawings.

As shown in FIG. 1, a switching hub according to the present invention comprises a CPU 101, a console control unit 102 for controlling a console 103, a nonvolatile memory 10
4. Memory 105 used for reception buffer, destination determination unit 106, transfer control unit 107, communication L of each port 1 to n
SI109 (1091-109n) and each port 1
n link state registers 112 (1121-112)
n) are interconnected via a transfer data bus 108. 6 is different from the switching hub of FIG. 6 in that a link state register 112 is provided.

Here, the link state indicates a connection state of a terminal. When an operating (powered) terminal is connected to a port, the link state of the port is "on". If the terminal is not connected or the terminal is connected but the power is turned off, the link state of the port is “off”.
It is. The link state register 112 detects the link state of the port, and when the CPU 101 receives a read command, notifies the CPU 101 of the state.

In the conventional switching hub, the admin state is set / changed by inputting the admin state change command from the console 103, and is further stored in the nonvolatile memory 104. When the time during which the terminal is not connected exceeds a predetermined time, it is automatically changed.

The operation of the switching hub shown in FIG. 1 will be described. First, the administrator of the switching hub checks the console 1
03, the admin state is automatically turned off.
Enter the time to be set in. This auto-off setting time may be common to all ports or may be individual for each port. The value of the automatic off setting time is written to the nonvolatile memory 104 or the reception buffer memory 105. The CPU 101 of the switching hub periodically reads the link state of each port and sets the state to “of”.
If “f”, the automatic off set time is counted.
The 101 compares the preset time with the counted time, and when the time exceeds the set time, sets the admin state of the port to “off”. If the link state of the port returns from “off” to “on” before the set time, the CPU 101 resets the count value of the auto-off set time of the port.

The switching hub of the present invention automatically sets the admin state of an unused port to “off” after a preset time, thereby setting only the port on which the terminal actually operates and performs communication to “off”. By setting “on”, a malicious user can be prevented from suddenly trying to access using an unused port, and important information can be protected.

Next, another embodiment of the present invention will be described.

As shown in FIG. 2, the switching hub according to the present invention includes a CPU 101, a switching control unit 113, a memory 105, a destination determining unit 106, a transfer control unit 107, and a communication LSI 109 (1091) for each of the ports 1 to n. -10
9n) are interconnected via a transfer data bus 108. The switching hub of FIG.
In that it has The switch control unit 113 does not perform new registration when a frame whose source address is not registered is received, and the security mode in which the frame is discarded. Is performed, and the conventional mode of relaying the frame is selected.

The switching hub first operates in the conventional mode. That is, when a frame whose source address is unregistered is received, new registration is performed by associating the source address with the port. Thereby, the address of the terminal connected to each port can be registered in the address table. When the registration of all terminals is completed, a switching signal is input from the outside to the switching control unit 113, and the switching control unit 113
Switches the mode to security mode. Thereafter, when a frame whose source address is unregistered is received, new registration is not performed and the frame is discarded.

As described above, the switching hub of the present invention
Only terminals whose addresses are registered in advance are allowed to communicate, and communication from newly connected unregistered terminals is prohibited. As a result, important information can be protected from access by a malicious user.

[0025]

The present invention exhibits the following excellent effects.

(1) Since unused ports are automatically set to be unusable, network security can be improved.

(2) New registration of a terminal that has not been registered in advance is not performed, and the frame is discarded, so that the security of the network can be improved.

[Brief description of the drawings]

FIG. 1 is an internal configuration diagram of a switching hub showing one embodiment of the present invention.

FIG. 2 is an internal configuration diagram of a switching hub showing another embodiment of the present invention.

FIG. 3 is a flowchart of a process in the switching hub of FIG. 2;

FIG. 4 is an internal configuration diagram of a conventional switching hub.

FIG. 5 is a flowchart of a process in the switching hub of FIG. 4;

FIG. 6 is an internal configuration diagram of a conventional switching hub.

[Explanation of symbols]

101 CPU 104 Nonvolatile Memory 105 Memory 106 Destination Judgment Unit 107 Transfer Control Unit 109 (1091 to 109n) Communication LSI 110 (1101 to 110n) Admin State Register 112 (1121 to 112n) Link State Register

Claims (3)

[Claims] 1. A nonvolatile nonvolatile memory having a plurality of ports used for transmitting and receiving a frame, relaying a received frame to a port corresponding to a destination, and storing a state variable of “available” or “unavailable” for each port. A switching hub that has a non-volatile memory and sets port availability / non-usability according to a state variable read from the non-volatile memory at power-on or reset, and detects whether a terminal is connected to the port. A switching hub for setting a port to be unusable when a time period during which a terminal is not connected exceeds a predetermined time. 2. An apparatus having an address table which has a plurality of ports and registers addresses of connected terminals in correspondence with the ports, searches the address table by a destination address of the frame, and relays the frame to the corresponding port. In the switching hub, the address of the terminal connected to each port is registered in the address table in advance, and even if a frame whose source address is unregistered is received, new registration in the address table is performed. A switching hub, wherein the frame is discarded and the frame is discarded. 3. When a frame whose source address is unregistered is received, new registration in the address table is not performed, and the frame is discarded. 3. The switching hub according to claim 2, wherein registration and a mode for relaying a frame can be selected.