Terminal affiliation switchover system
In the terminal affiliation switchover system of the invention, in the case of allocation of an IP address to one terminal in a VPN# 1 in response to an IP address allocation request, a DHCP server module 121 changes registry information in a DHCP table 122 provided for the VPN# 1 and simultaneously makes the change of the registry information reflected in registry of a DHCP table 222 provided for a VPN# 2 via a DHCP server module 221 . Similarly in the case of allocation of an IP address to one terminal in the VPN# 2 in response to an IP address allocation request, the DHCP server module 221 changes the registry information in the DHCP table 222 for the VPN# 2 and simultaneously makes the change of the registry information reflected in the registry of the DHCP table 122 for the VPN# 1 via the DHCP server module 121.
1. A terminal affiliation switchover system that switches over affiliation of a terminal at least between a first network and a second network, the terminal affiliation switchover system comprising:
a terminal affiliation switchover module, implemented by a processor, configured to acquire authentication information from a user of the terminal and switch over the affiliation of the terminal between the first network and the second network;
an authentication server configured to authenticate the terminal based on the authentication information;
a quarantine server connected to the first network configured to allow the terminal to satisfy a predetermined security policy;
a first dynamic host configuration protocol (DHCP) server module connected to the first network, implemented by a processor, configured to allocate an Internet Protocol (IP) address to the terminal;
a second dynamic host configuration protocol (DHCP) server module connected to the second network, implemented by a processor, configured to allocate another Internet Protocol (IP) address to the terminal;
in response to successfully authenticating the terminal, the terminal affiliation switchover module:
determines whether or not the terminal satisfies the predetermined security policy by making an inquiry to the quarantine server; and
in response to determining that the terminal does not satisfy the predetermined security policy, affiliating the terminal with the first network, wherein the quarantine server allows the terminal to satisfy the predetermined security policy;
wherein once the terminal satisfies the predetermined security policy, the terminal affiliation switchover module switches over the affiliation of the terminal to the second network connected with a business server;
wherein the first DHCP server module allocates a first IP address to the terminal based on registry information in a first DHCP table when the terminal is affiliated with the first network;
wherein the second DHCP server module allocates a second IP address to the terminal based on registry information in a second DHCP table when the terminal is affiliated with the second network;
wherein the first network and the second network are independent Virtual Private Networks (VPNs) or virtual private networks that are not mutually communicable and separately and independently perform routing and forwarding operations, and wherein allocatable ranges of IP addresses, which are allocated to the terminal by the first DHCP server module and the second DHCP server module, respectively overlap,
wherein at every time of any change of the registry information in one of the first DHCP table and the second DHCP table, the first DHCP server module and the second DHCP server module make the change of the registry information reflected in the registry information in the other of the first DHCP table and the second DHCP table, so that the first DHCP table and the second DHCP table have at least identical mapping information representing a correlation of the terminal to the IP address, and
wherein the terminal, the terminal affiliation switchover module, the quarantine server, the authentication server, and the business server are separate devices.
2. The terminal affiliation switchover system in accordance with claim 1 , wherein the terminal affiliation switchover module, the first DHCP server module, and the second DHCP server module are incorporated in one identical device.
3. The terminal affiliation switchover system in accordance with claim 1 , wherein the first DHCP server module and the second DHCP server module are incorporated in one identical device, and the terminal affiliation switchover module is provided separately in a different device other than the identical device.
4. The terminal affiliation switchover system in accordance with claim 3 , wherein the first DHCP server module and the second DHCP server module are incorporated in one identical packet relay device.
5. The terminal affiliation switchover system in accordance with claim 1 , wherein the first DHCP server module and the second DHCP server module are provided separately in different devices.
6. The terminal affiliation switchover system in accordance with claim 1 , wherein the terminal uses the same IP address in the second network as the one used in the first network when the affiliation of the terminal is switched over from the first network to the second network by the terminal affiliation switchover module.
7. A terminal affiliation switchover system that switches over affiliation of a terminal at least between a first network and a second network, the terminal affiliation switchover system comprising:
a terminal affiliation switchover module, implemented by a processor, configured to acquire authentication information from a user of the terminal and switch over the affiliation of the terminal between the first network and the second network;
an authentication server configured to authenticate the terminal based on the authentication information;
a quarantine server connected to the first network configured to allow the terminal to satisfy a predetermined security policy;
a dynamic host configuration protocol (DHCP) server module, implemented by a processor, configured to allocate an Internet Protocol (IP) address to the terminal;
in response to successfully authenticating the terminal, the terminal affiliation switchover module:
determines whether or not the terminal satisfies the predetermined security policy by making an inquiry to the quarantine server; and
in response to determining that the terminal does not satisfy the predetermined security policy, affiliating the terminal with the first network, wherein the quarantine server allows the terminal to satisfy the predetermined security policy;
wherein once the terminal satisfies the predetermined security policy, the terminal affiliation switchover module switches over the affiliation of the terminal to the second network connected with a business server;
wherein the DHCP server module allocates a first IP address to the terminal based on registry information in a first DHCP table when the terminal is affiliated with the first network;
wherein the DHCP server module allocates a second IP address to the terminal based on registry information in a second DHCP table when the terminal is affiliated with the second network;
wherein the first network and the second network are independent Virtual Private Networks (VPNs) or virtual private networks that are not mutually communicable and separately and independently perform routing and forwarding operations, and wherein allocatable ranges of IP addresses, which are allocated to the terminal by the first DHCP server module and the second DHCP server module, respectively overlap,
wherein at every time of any change of the registry information in one of the first DHCP table and the second DHCP table, the first DHCP server module and the second DHCP server module make the change of the registry information reflected in the registry information in the other of the first DHCP table and the second DHCP table, so that the first DHCP table and the second DHCP table have at least identical mapping information representing a correlation of the terminal to the IP address, and
wherein the terminal, the terminal affiliation switchover module, the quarantine server,
the authentication server, and the business server are separate devices.
8. A terminal affiliation switchover system that switches over affiliation of a terminal at least between a first network and a second network, the terminal affiliation switchover system comprising:
a plurality of packet relay devices implementing a virtual router redundancy protocol (VRRP);
a first packet relay device of the plurality of packet relay devices configured to operate as a master and a second packet relay device of the plurality of packet relay devices configured to operate as a backup;
the first packet relay device of the plurality of packet relay devices configured to operate as a master further comprises:
a terminal affiliation switchover module, implemented by a processor, configured to acquire authentication information from a user of the terminal and switch over the affiliation of the terminal between the first network and the second network;
an authentication server configured to authenticate the terminal based on the authentication information;
a quarantine server connected to the first network configured to allow the terminal to satisfy a predetermined security policy;
a first dynamic host configuration protocol (DHCP) server module connected to the first network, implemented by a processor, configured to allocate an Internet Protocol (IP) address to the terminal;
a second dynamic host configuration protocol (DHCP) server module connected to the second network, implemented by a processor, configured to allocate another Internet Protocol (IP) address to the terminal;
in response to successfully authenticating the terminal, the terminal affiliation switchover module:
determines whether or not the terminal satisfies the predetermined security policy by making an inquiry to the quarantine server; and
in response to determining that the terminal does not satisfy the predetermined security policy, affiliating the terminal with the first network, wherein the quarantine server allows the terminal to satisfy the predetermined security policy;
wherein once the terminal satisfies the predetermined security policy, the terminal affiliation switchover module switches over the affiliation of the terminal to the second network connected with a business server;
wherein the first DHCP server module allocates a first IP address to the terminal based on registry information in a first DHCP table when the terminal is affiliated with the first network;
wherein the second DHCP server module allocates a second IP address to the terminal based on registry information in a second DHCP table when the terminal is affiliated with the second network;
the second packet relay device of the plurality of packet relay devices configured to operate as a backup further comprises:
a second terminal affiliation switchover module, implemented by a processor, configured to acquire authentication information from the user of the terminal and switch over the affiliation of the terminal between the first network and the second network when the second packet relay device is appointed as a new master;
the authentication server configured to authenticate the terminal based on the authentication information acquired by the second terminal affiliation switchover module;
the quarantine server connected to the first network configured to allow the terminal to satisfy a predetermined security policy;
a third dynamic host configuration protocol (DHCP) server module connected to the first network, implemented by a processor, configured to allocate the Internet Protocol (IP) address to the terminal when the second packet relay device is appointed as a new master;
a fourth dynamic host configuration protocol (DHCP) server module connected to the second network, implemented by a processor, configured to allocate the another Internet Protocol (IP) address to the terminal when the second packet relay device is appointed as a new master;
in response to successfully authenticating the terminal, the second terminal affiliation switchover module:
determines whether or not the terminal satisfies the predetermined security policy by making an inquiry to the quarantine server when the second packet relay device is allocated as a new master; and
in response to determining that the terminal does not satisfy the predetermined security policy, affiliating the terminal with the first network, wherein the quarantine server allows the terminal to satisfy the predetermined security policy;
wherein once the terminal satisfies the predetermined security policy, the second terminal affiliation switchover module switches over the affiliation of the terminal to the second network connected with a business server when the second packet relay device is appointed as a new master;
wherein the third DHCP server module allocates a third IP address to the terminal based on registry information in a third DHCP table when the terminal is affiliated with the first network when the second packet relay device is appointed as a new master;
wherein the fourth DHCP server module allocates a fourth IP address to the terminal based on registry information in a fourth DHCP table when the terminal is affiliated with the second network when the second packet relay device is appointed as a new master;
wherein the first network and the second network are independent Virtual Private Networks (VPNs) or virtual private networks that are not mutually communicable and separately and independently perform routing and forwarding operations, and wherein allocatable ranges of IP addresses, which are allocated to the terminal by the first DHCP server module and the second DHCP server module, respectively overlap,
wherein at every time of any change of the registry information in one of the first DHCP table and the second DHCP table, the first DHCP server module and the second DHCP server module in the first packet relay device set as the master make the change of the registry information reflected in the registry information in the other of the first DHCP table and the second DHCP table and in the registry information in both the third DHCP table and the fourth DHCP table in the second packet relay device set as the backup, so that the first DHCP table and the second DHCP table in the first packet relay device and the third DHCP table and the fourth DHCP table in the second packet relay device have at least identical mapping information representing a correlation of the terminal to the IP address, and
wherein the terminal, the terminal affiliation switchover module, the quarantine server, the authentication server, and the business server are separate devices.