JP2005005927A - Network system, unauthorized access control method, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an unauthorized access detecting service without deteriorating the communication quality in a network system which connect the digital information transmitting networks to each other. <P>SOLUTION: An information transfer processor 2 detects, by using simple processing, at high speed whether the information to be transferred is based on an unauthorized access, and transfers the information based on the authorized access as usual, and transfers only the information whose unauthorized access is suspected not to the original destination but to a detail testing device 3. The detail testing device 3 carefully and strictly checks whether the transferred information is based on an unauthorized access by comparing the information with the information in the unauthorized access database 6, and when the information is not based on the unauthorized access, transfers the information to the original destination, but when it is based on the unauthorized access, records the information in an information recording device 4 without transferring it to the original destination. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a network system technology that provides a wide area network service by connecting a plurality of digital information transmission networks, and more particularly to improve security by efficiently monitoring and preventing unauthorized access between digital networks. The present invention relates to a suitable network system.
[0002]
[Prior art]
With the spread of public IP (Internet Protocol) networks such as the Internet, threats such as illegal eavesdropping, destruction, and tampering of data due to unauthorized access via the network always exist, and an abnormal load is imposed on the network and servers. Threats such as attacks that make network devices or server systems virtually inoperable are rapidly increasing.
[0003]
In order to deal with these threats, an access control technique for controlling communication according to the contents of data flowing through the network or the user authority of the transmission source is generally employed.
[0004]
This control technology is generally realized by implementing a function known as a firewall in a packet processing device such as a router. This packet processing device is connected to an external network such as the Internet and an internal network such as an intranet. It is installed at the boundary of the network and performs access control that allows only the minimum necessary communication according to the security policy.
[0005]
The firewall function for performing access control includes an access control function at the IP level by IP filtering, an access control function for each TCP port at the TCP (Transport Control Protocol) level, and performs access control according to the contents of communication. Broadly divided into access control functions at the application level.
[0006]
In a communication system having these functions, communication access can be controlled according to the type, content, and direction of communication. In addition, the security design based on the security policy determines the access control method, defines various parameters for access control, and further sets the parameters in the packet processing device that has a firewall function. Network operation can be performed.
[0007]
However, with the firewall function described above, it is difficult to completely prevent unauthorized access such as unauthorized intrusion using this passable communication service because communication through the security policy is allowed to pass through the network. is there. In order to compensate for this problem, a security monitoring device for detecting unauthorized intrusion, generally known as IDS (Intrusion Detection System), has been adopted.
[0008]
This monitoring apparatus employs a method of monitoring all communication data flowing through the firewall function and constantly monitoring the presence or absence of unauthorized communication. For example, it is possible to create a database of data related to illegal activities such as known intrusions, compare received data with previously stored illegal access patterns, and reduce traffic of unauthorized access by traffic shaving when a match is detected.
[0009]
In addition, there is a technique for blocking traffic by filtering instead of reducing traffic of IP packets used for unauthorized access by traffic shaping.
[0010]
However, such a conventional packet processing apparatus has the first and second problems. First, as a first problem, traffic shaving and filtering processing is performed in the received packet processing device for an illegally accessed IP packet, so that the processing load of the packet processing device increases and the illegally accessed IP packet Consume bandwidth. For this reason, even if it was possible to protect against unauthorized access, communication quality between terminals was likely to deteriorate.
[0011]
In addition, as a second problem, these packet processing devices need to be arranged immediately before the device that is to be protected from unauthorized access. A plurality of packet processing devices must be arranged in the network.
[0012]
As conventional techniques for solving such a problem, there are techniques described in Patent Documents 1 to 5, for example.
[0013]
In Patent Document 1, a network denial-of-service attack (DDoS) that performs a DoS (Denial of Services) attack in cooperation from a plurality of locations simultaneously is provided at the network boundary as a technique for efficiently protecting the attacked side. The communication device that monitors the communication packet passing through the communication device is detected by the communication device, detects the distributed denial-of-service attack, discards the communication packet of the distributed denial-of-service attack, and closes the upper communication device close to the attack source An attack source search module program for searching the address of the host is transmitted, the attack source search module program is transmitted to the communication device at the higher-level defense position, and further candidates for higher-level communication devices close to the attack source A communication device as a higher defense position is extracted from the inside, and the attack defense module is extracted from the communication device at this defense position. By sending le program, technology that does not pass all traffic from DoS attacker is described.
[0014]
In Patent Document 2, the security provided to the communication packet on the transmission side for the purpose of easily realizing countermeasures for the DoS attack including the indefinite address DoS attack even in the ISP (Internet Service Provider). Depending on the degree of confirmation, a different type of safety identifier is added to the communication packet, and priority control is performed according to the safety identifier on the delivery route of the communication packet, thereby achieving higher safety confirmation. A technique is described in which a broken packet is preferentially connected to a destination and other packets are discarded. Since address-indefinite DoS attacks are performed using packets that have not been fully secured, such packets are used for attacks when the priority is lowered and the bandwidth exceeds the capacity allowed. The received packet is discarded, and the indefinite address DoS attack becomes invalid.
[0015]
In Patent Document 3, as a technique for defending against a distributed denial-of-service attack (DDoS) in which a DoS (Denial of Services) attack is performed simultaneously in cooperation from a plurality of locations, the situation of the network is monitored in a defending network. Describes a technology that instructs an attack blocking device belonging to a host that performs unauthorized access to control communication with the corresponding step host when an unauthorized access (DDoS attack) to the attack target host is detected based on a sudden increase in access ing.
[0016]
In Patent Document 4, an unauthorized person who has entered through an IP network of another carrier (another provider) is detected at a boundary portion to identify and block the unauthorized person at a high speed (in a short time). For this purpose, in each of the plurality of boundary relay devices located at the boundary portions of each IP network, when the transmitted IP packet is an illegal intrusion packet, the re-intrusion of the illegal packet is detected. A technique is described in which when a re-intrusion is detected based on filtering information, the illegal packet is discarded and the filtering information is distributed to other boundary relay apparatuses.
[0017]
Patent Document 5 protects against attacks from the Internet without forcing the user to introduce security-related network devices such as firewalls and IDS and to acquire knowledge for operating the introduced network devices. For this purpose, the network operator distinguishes the data to be inspected based on the user's specification (for example, specification of the transmission source, specification of the port number, etc.), and the data specified as the inspection target is sent to the inspection server, This inspection server investigates whether or not the data is an attack, and the network operator provides to the user by selecting only the data that does not attack and the data that is not designated as the inspection target from the survey results Is described.
[0018]
[Patent Document 1]
JP 2002-164938 A [Patent Document 2]
JP 2002-158699 A [Patent Document 3]
JP 2002-158660 A [Patent Document 4]
JP 2002-185539 A [Patent Document 5]
Japanese Patent Laid-Open No. 2002-335246
These conventional techniques can provide a service for preventing unauthorized access at the network boundary without imposing a load on the user. However, it takes time to detect unauthorized access, and the information transfer speed decreases.
[0020]
[Problems to be solved by the invention]
The problem to be solved is that the conventional technology can provide a service for preventing unauthorized access without imposing a load on the user at the network boundary, but it takes time to detect unauthorized access. Is a point.
[0021]
An object of the present invention is to solve these problems of the prior art and to provide an unauthorized access detection service without deteriorating communication quality.
[0022]
[Means for Solving the Problems]
In order to achieve the above object, the present invention first performs a normal information transfer process between digital information transmission networks when detecting information for unauthorized access among the information transferred between digital information transmission networks. In the transfer processing device, the information is simply inspected to detect the possibility of unauthorized access at high speed, and only the information detected as having unauthorized access in this simple inspection is transferred to the detailed inspection device. The information is scrutinized to strictly detect the presence or absence of unauthorized access.
[0023]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
[0024]
FIG. 1 is a block diagram showing a configuration example of a network system having an unauthorized access control service function according to the present invention, FIG. 2 is a flowchart showing a first processing operation example of the network system in FIG. 1, and FIG. FIG. 5 is a flowchart showing a second processing operation example of the network system in FIG. 1. FIG.
[0025]
In FIG. 1, reference numeral 1 denotes a network system having an unauthorized access control service function according to the present invention, which includes information transfer processing devices 2A to 2D and a detailed inspection device 3, and connects a plurality of digital information transmission networks 5A to 5F. The information between the digital information transmission networks 5A to 5F is transferred to the designated digital information transmission networks 5A to 5F.
[0026]
Each of the information transfer processing devices 2A to 2D and the detailed inspection device 3 has a computer configuration including a CPU (Central Processing Unit), a main memory, a display device, an input device, an external storage device, and the like. After the program and data recorded in a storage medium such as a CD-ROM are installed in the external storage device, the function of each processing unit is executed by reading the program and data from the external storage device into the main memory and processing them by the CPU.
[0027]
For example, as shown in the information transfer processing device 2A, each of the information transfer processing devices 2A to 2D includes a transmission / reception unit 21, an unauthorized access detection unit 22, an unauthorized access estimation unit 23, a transfer control unit 24, and a notification unit 25. The detailed inspection device 3 includes a transmission / reception unit 31, first to third determination units 32 to 34, an unauthorized access database 6, and an information recording device 4.
[0028]
With such a configuration, when the network system 1 of this example detects information for unauthorized access among the information transferred between the digital information transmission networks, first, the network system 1 of the example is a normal one between the digital information transmission networks 5A to 5F. In the transfer processing devices 2A to 2D that perform the information transfer processing, the information is simply inspected to detect the possibility of unauthorized access at a high speed, and only the information detected by the simple inspection as having unauthorized access is sent to the detailed inspection device 3 Then, the detailed inspection apparatus 3 examines the information and strictly detects the presence or absence of unauthorized access.
[0029]
For example, the transfer processing devices 2A to 2D perform normal information transfer processing between the digital information transmission networks 5A to 5F by the transmission / reception unit 21, and the unauthorized access detection unit 22 transmits the information based on the content of the received information. Whether or not the purpose is unauthorized access is identified at high speed by simple processing, and the unauthorized access estimation unit 23 transmits the amount of information received, the reception interval, the transmission source information, the transmission destination information, and the content of the information. Based on at least one of the above, it is estimated at high speed whether or not the transmission purpose of the information is unauthorized access.
[0030]
When the unauthorized access detection unit 22 detects unauthorized access or when the unauthorized access estimation unit 23 estimates unauthorized access, the transfer control unit 24 transfers the information to the detailed inspection device 3 and notifies the notification unit. 25 to notify the detailed inspection apparatus 3.
[0031]
At this time, the transfer processing devices 2A to 2D temporarily transfer all information including the information detected as having the possibility of unauthorized access to the designated digital information transmission networks 5A to 5F as usual. In the case where unauthorized access is detected by strict unauthorized access detection in the inspection device 3, a configuration in which transfer of the information in the subsequent transfer processing devices 2A to 2D is stopped, or unauthorized access is performed in the transfer processing devices 2A to 2D. The information detected as having possibility is stopped at the normal transfer at that time, and the normal transfer to the information is started after waiting for the detection result of no unauthorized access in the strict unauthorized access detection in the detailed inspection device 3. .
[0032]
The detailed inspection device 3 receives the information detected by the transfer processing devices 2A to 2D as having the possibility of unauthorized access at the transmission / reception unit 31, and scrutinizes this information at the first to third determination units 32 to 34. Strictly determine whether it is unauthorized access over time.
[0033]
For example, the first determination unit 32 determines whether the information transferred from the information transfer processing devices 2 </ b> A to 2 </ b> D is unauthorized access based on a comparison with data regarding past unauthorized access held in the unauthorized access database 6. In the second determination unit 33, the information amount of information transferred from the information transfer processing devices 2A to 2D, the transfer interval of similar information, the source and destination address information, Based on at least one of the types of destination terminals, it is determined whether or not the information is unauthorized access, and the third determination unit 34 determines past information held in the unauthorized access database 6. Whether the information is unauthorized access is determined based on the difference between the transfer history and the current transfer state.
[0034]
When any of these first to third determination units 32 to 34 determines that the access is unauthorized, the detailed inspection device 3 notifies the information transfer processing devices 2A to 2D of the determination result by the transmission / reception unit 31. To do.
[0035]
When any of these first to third determination units 32 to 34 determines that the access is not unauthorized, the detailed inspection device 3 notifies the information transfer processing devices 2A to 2D of the determination result by the transmission / reception unit 31. Then, the information is transferred via the network system 1 to the designated destination digital information transmission networks 5A to 5F.
[0036]
The detailed inspection device 3 does not necessarily have to notify the information transfer processing devices 2A to 2D of the determination result. The information determined by the detailed inspection apparatus 3 as not being unauthorized access may be transferred by the detailed inspection apparatus 3 to a designated destination digital information transmission network, or information received from the detailed inspection apparatus 3 The transfer processing devices 2A to 2D may transfer to a designated destination digital information transmission network.
[0037]
As described above, the information recording device 4 records information detected by the transfer processing devices 2A to 2D as the possibility of unauthorized access and information detected as unauthorized access by strict unauthorized access detection in the detailed inspection device 3. When the recorded information satisfies a predetermined condition, the information recording apparatus 4 notifies a predetermined management terminal that the information is unauthorized access.
[0038]
In this example, the network system 1 digitally transmits the digital information transfer networks 5A and 5B via the information transfer processing device 2A, the digital information transfer network 5C via the information transfer processing device 2B, and the digital information via the information transfer processing device 2C. The information transmission networks 5D and 5E are connected to the digital information transmission network 5F via the information transfer processing device 2D. The detailed inspection apparatus 3 includes an unauthorized access database 6 that stores unauthorized access data.
[0039]
Hereinafter, the information transfer processing devices 2A to 2D will be referred to as the information transfer processing device 2, and the digital information transmission networks 5A to 5F will be referred to as the digital information transmission network 5, and the processing operation of the network system 1 in such a configuration will be described with reference to FIGS. explain.
[0040]
As shown in FIG. 2, the information transfer processing device 2 receives information to be transferred from the connected digital information transmission network 5 (step 201), and determines the information transfer processing device 2 to be transferred from the destination information of the received information. To do.
[0041]
At this time, the information transfer processing device 2 determines whether or not the received information is unauthorized access (step 202), and when it is determined that it is unauthorized access or when it is notified that it is unauthorized access (Step 203), the information is discarded (Step 204), and the determination result is notified to the detailed inspection apparatus 3 (Step 205).
[0042]
If it is not determined that the access is unauthorized (step 203), an unauthorized access estimation process is performed (step 206).
[0043]
Information determined that there is no possibility of unauthorized access in this estimation result (step 207) is transferred to a specified destination by normal transfer processing (step 208), but the estimation result that there is a possibility of unauthorized access is obtained. If there is (step 207), the detailed inspection apparatus 3 is notified of the estimation result, the information is transferred (step 209), and the detailed unauthorized access detection processing result in the detailed inspection apparatus 3 is awaited (step 210).
[0044]
At this time, the information may not be transferred to the information transfer device 2 on the side of the digital information transfer network 5 to which the information is to be transferred, or may be transferred to both the information transfer device 2 and the detailed inspection device 3 that are to be transferred originally. You can do it.
[0045]
If the detailed unauthorized access detection processing result in the detailed inspection apparatus 3 is not unauthorized access (step 211), normal information transfer is continued (step 208). If it is a detection result of unauthorized access (step 211), The transfer of information to the information transfer device 2 on the digital information transfer network 5 side where the information is to be transferred is stopped (step 213).
[0046]
As shown in FIG. 3, when the detailed inspection apparatus 3 receives the information transferred from the information transfer processing apparatus 2 (steps 301 and 302), the detailed inspection apparatus 3 stores the data held in the unauthorized access database 6 in the detailed inspection apparatus 3 The received information and the incidental information of the information are compared to determine whether or not the received information is unauthorized access (step 303).
[0047]
If it is determined that the access is unauthorized (step 304), the related information transfer processing device 2 and the information recording device 4 are notified of the result (step 305), the received information is transferred to the information recording device 4, and the information is recorded. The recording device 4 records the information and the result of the unauthorized access determination (step 306), so that the network system administrator can refer to the information. Alternatively, the administrator is notified in accordance with preset conditions.
[0048]
If it is determined that the access is not unauthorized (step 304), the related information transfer processing device 2 and the information recording device 4 are notified of the result (step 307), and the received information is sent to the digital information transmission network 5 to which the original information should be transferred. The information is transferred to the information transfer processing device 2 to be connected (step 308).
[0049]
At this time, the information transfer processing device 2 or the detailed inspection device 3 may transfer the information. When the detailed inspection device 3 transfers the information, the detailed inspection device 3 may or may not notify the information transfer processing device 2 of the determination result.
[0050]
As described above with reference to FIGS. 1 to 3, the network system 1 of this example connects a plurality of digital information transmission networks 5 </ b> A to 5 </ b> F to each other, and information between these digital information transmission networks 5 </ b> A to 5 </ b> F. To the designated destination digital information transmission networks 5A to 5F, the internal structure of the network system 1 is concealed from the digital information transmission networks 5A to 5F, and the network system 1 and the digital information transmission network 5A are concealed. In the information transfer processing devices 2A to 2D located at the boundary of ~ 5F, the unauthorized access transmitted from the digital information transmission networks 5A to 5F is detected, and the information detected as unauthorized access is transferred to a destination other than originally intended. Detailed inspection to inspect and record unauthorized access in detail at the forwarding destination A configuration to deploy a location 3.
[0051]
Alternatively, the information transfer processing devices 2A to 2D detect signs of unauthorized access or receive unauthorized access notifications and transfer accesses suspected of unauthorized access to the detailed inspection device 3. By checking in detail whether the access is unauthorized access, it distinguishes between unauthorized access and authorized access, forwards only authorized access to the originally intended destination, and redirects unauthorized access to the originally intended destination. By not forwarding, the regular access is prevented from being disturbed due to mass transmission of unauthorized access. When receiving an unauthorized access end notification from the detailed inspection device 3, the information transfer processing devices 2A to 2D subsequently transfer the access (information) transferred to the detailed inspection device 3 to the originally intended destination. .
[0052]
Thus, according to this example, even when an unauthorized access occurs between the digital information transmission networks 5A to 5F, the unauthorized access can be detected, transferred, defended, and recorded on the network system 1 side. Services provided in the information transmission networks 5A to 5F and regular access can be used normally without being affected by unauthorized access.
[0053]
In this case, in this example, the unauthorized access detection process in the network system 1 is divided into two stages. First, high-speed unauthorized access detection is performed with easy processing, and only for information detected as unauthorized access here, It is configured to detect unauthorized access strictly with finer processing, and for regular access, only simple and high-speed unauthorized access detection is performed, so that the transfer efficiency of regular access is improved and the characteristics and performance of network services are improved. It becomes possible to improve the transmission efficiency.
[0054]
In addition, this invention is not limited to the example demonstrated using FIGS. 1-3, In the range which does not deviate from the summary, various changes are possible. For example, in this example, the unauthorized access database 6 and the information recording device 4 are provided in the detailed inspection device 3, but the unauthorized access database 6 and the information recording device 4 are provided separately from the detailed inspection device 3. Also good.
[0055]
In this example, both the unauthorized access detection unit 22 and the unauthorized access estimation unit 23 are provided in the information transfer processing devices 2A to 2D. However, the information transfer processing devices 2A to 2D may have at least one of them. Similarly, the first to third determination units 32 to 34 in the detailed inspection apparatus 3 may be configured to have at least one of them.
[0056]
Further, as a computer configuration example of this example, a computer configuration without a keyboard or an optical disk drive device may be used. In this example, an optical disk is used as a recording medium. However, an FD (Flexible Disk) or the like may be used as a recording medium. As for the program installation, the program may be downloaded and installed via a network via a communication device.
[0057]
【The invention's effect】
According to the present invention, even when unauthorized access occurs between digital information transmission networks, the network system detects, transfers, defends, and records unauthorized access on the digital information transmission network. Regular access can be used as normal without being affected by unauthorized access. In addition, regular access only performs simple and high-speed unauthorized access detection, improving the transfer efficiency of regular access. Therefore, it is possible to improve the characteristics and performance of network services and improve transmission efficiency, thereby protecting against unauthorized access and at the same time eliminating deterioration in communication quality.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a configuration example of a network system having an unauthorized access control service function according to the present invention.
FIG. 2 is a flowchart showing a first processing operation example of the network system in FIG. 1;
FIG. 3 is a flowchart showing a second processing operation example of the network system in FIG. 1;
[Explanation of symbols]
1: Network system, 2A-2D: Information transfer processing device, 3: Detailed inspection device, 4: Information recording device, 5A-5F: Digital information transmission network, 6: Unauthorized access database, 21: Transmitter / receiver, 22: Unauthorized access Detection unit, 23: Unauthorized access estimation unit, 24: Transfer control unit, 25: Notification unit, 31: Transmission / reception unit, 32-34: First to third determination units.

Claims (10)

A network system for connecting a plurality of digital information transmission networks and transferring information between the digital information transmission networks to a designated destination digital information transmission network,
Detailed inspection means that scrutinize the above information and detect unauthorized access;
The information between the digital information transmission networks is transferred to the designated digital information transmission network, and the received information is simply inspected to determine whether there is a possibility of unauthorized access. Transfer processing means for transferring information to the detailed inspection means,
A network system characterized in that when an unauthorized access is detected by the detailed inspection means, the transfer processing means stops transferring the information to a designated digital information transmission network. A network system for connecting a plurality of digital information transmission networks and transferring information between the digital information transmission networks to a designated destination digital information transmission network,
Detailed inspection means for scrutinizing the above information and detecting unauthorized access,
The information from the above digital information transmission network is simply inspected to determine the possibility of unauthorized access, and the information that is determined to be unauthorized access is transferred to the designated destination digital information transmission network and The information determined to be possible has transfer processing means for transferring to the detailed inspection means, and if the unauthorized inspection is not detected by the detailed inspection means, the transfer processing means sends the information to the designated digital information transmission network. A network system characterized by transferring. The network system according to claim 2,
The transfer processing means transfers all the information from the other transfer processing means to the designated digital information transmission network, and determines whether there is unauthorized access by the simple inspection and information to the detailed inspection means. A network system characterized by performing transfer and stopping transfer of the information to a designated digital information transmission network by the transfer processing means when the detailed inspection means detects unauthorized access. The network system according to any one of claims 1 to 3,
The information that the transfer processing means has determined that there is a possibility of unauthorized access and the information that is detected as unauthorized access by the detailed inspection means are recorded, and if the recorded information satisfies a predetermined condition, the information is illegally accessed. A network system comprising information recording means for notifying a predetermined management terminal of the fact. A network system according to any one of claims 1 to 4, wherein
The transfer processing means includes
Detection means for identifying whether or not the purpose of transmitting the information is unauthorized access based on the content of the received information;
At least one of estimation means for estimating that the transmission purpose of the information is unauthorized access based on at least one of the transmission amount, reception interval, transmission source information, transmission destination information, and information content of the received information A network system characterized by having one. A network system according to any one of claims 1 to 5,
The detailed inspection means is
First determination means for holding data relating to past unauthorized access and determining whether the information transferred from the transfer processing means is unauthorized access based on comparison with the data;
The information can be illegally accessed based on at least one of the amount of information transferred from the transfer processing means, the transfer interval of similar information, the source and destination address information, and the type of the destination terminal. A second determination means for determining whether or not there is a transfer history of past information, and the information transferred from the transfer processing means based on the difference between the stored transfer history and the current transfer state is illegal At least one of third determination means for determining whether or not access; and
And a means for notifying the information transfer processing means of the determination result when any of the first to third determining means determines that the access is unauthorized. A network system according to any one of claims 1 to 5,
The detailed inspection means is
First determination means for holding data relating to past unauthorized access and determining whether the information transferred from the transfer processing means is unauthorized access based on comparison with the data;
The information can be illegally accessed based on at least one of the amount of information transferred from the transfer processing means, the transfer interval of similar information, the source and destination address information, and the type of the destination terminal. A second determination means for determining whether or not there is a transfer history of past information, and the information transferred from the transfer processing means based on the difference between the stored transfer history and the current transfer state is illegal At least one of third determination means for determining whether or not access; and
Means for notifying the information transfer processing means of the determination result when at least one of the first to third determination means determines that the unauthorized access is not made by a combination of the respective,
And a means for transferring the information to a designated destination digital information transmission network via the network system. A program for causing a computer to function as each means in the network system according to any one of claims 1 to 7. An unauthorized access control method in a network that connects a plurality of digital information transmission networks and transfers information between the digital information transmission networks to a designated destination digital information transmission network,
A step of simply inspecting information from the digital information transmission network to detect the presence or absence of unauthorized access at a high speed;
A method for controlling unauthorized access, comprising: a step of closely detecting the unauthorized access when the unauthorized access is detected by the simple inspection. An unauthorized access control method in a network that connects a plurality of digital information transmission networks and transfers information between the digital information transmission networks to a designated destination digital information transmission network,
A step of simply inspecting information from the digital information transmission network to determine the possibility of unauthorized access; and
Transferring the information determined as having no possibility of unauthorized access to a designated destination digital information transmission network;
Transferring the information determined to have the possibility of unauthorized access to a predetermined address;
Receiving the information determined by the information checking means provided at the predetermined address as having the possibility of unauthorized access, and examining the information to determine the presence or absence of unauthorized access. Control method.

Images