JP2006332997A - Communication management device, network system, communication disconnecting method, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a communication device that gathers terminal information at low cost to disconnect illegal communication and has a small decrease in serviceability. <P>SOLUTION: The communication management device 10, an illegal communication detecting device 30, and a communication repeating device 40 are connected to a TCP/IP network 20. The communication management device 10 is equipped with a device connection constitution management section 11 which manages information on a connection between the illegal communication device 30 and communication repeating device 40, an illegal communication record gathering and analysis section 12 which gathers and analyzes illegal communication records related to a communication device that the illegal communication detecting device 30 has and then specifies the communication device having performed illegal communication, a communication repeating device retrieval section 13 which specifies the communication repeating device 40 and a connection port 45 to which the communication device is connected based upon information regarding the specified communication device, and a communication repeating device connection port disconnection section 14 which instructs the communication repeating device 40 to place the connection port 45 in an unusable state. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a communication management device, a network system, a communication blocking method in a network system, and a program, and in particular, a network system that blocks unauthorized communication, a communication management device in the network system, and blocking unauthorized communication in a network system. A method and a program.

  With the spread of the Internet, the exchange of various e-mails and access to WEB sites are rapidly increasing. Along with this, unauthorized access such as unauthorized attacks, intrusions, and information tampering is also increasing. In many cases, a device infected with a virus or worm performs unauthorized access regardless of the user's intention, and a system for blocking unauthorized communication from such a device is required.

  As such a system, for example, Patent Document 1 discloses a network management system. This system allows only terminals authenticated by terminal information such as host name (identification key), user ID (Identification Number), IP (Internet Protocol) address, MAC (Media Access Control) address, etc. to access the network. , To ensure network security.

  Further, Patent Document 2 discloses an attack source computer or a network to which an attack source computer that may be attacked before an attack is performed on the management target network and the computers in the management target network. By recognizing the network, a network blocking system is disclosed that enables appropriate precautions to be taken before an actual attack.

  This system detects an attack source computer that is attacking a network other than the managed network or an attack source network to which the attack source computer is connected by a network monitoring device installed in a network other than the managed network. If the managed network is not attacked, the network blockage judgment device blocks communication between the managed network and the attack source computer or between the managed network and the attack source network. It is.

JP 2002-141916 A Japanese Patent Laid-Open No. 2005-12606

  Incidentally, the network management system described in Patent Document 1 collects information of connected terminals and holds it in a management table. Based on the contents of this management table, permission / prohibition of port use is determined. For this reason, a procedure for collecting terminal information is necessary, and when the number of terminals is large, the cost for collection increases.

  On the other hand, in the network interruption system described in Patent Document 2, a management target network and a monitoring target network are separated, and a network monitoring device and a network relay device are also installed in each network. In such a network blocking system, communication between the managed network and the attack source computer or the attack source network may be blocked even when an attack is not performed on the managed network. Therefore, there is a possibility that communication of a computer (terminal) that is not an attack source connected to the management target network may be blocked, and serviceability may be deteriorated.

  Accordingly, an object of the present invention is to provide a communication management device, a network system, a communication blocking method in a network system, and a program that are low in the cost of collecting terminal information to block unauthorized communication and have little deterioration in serviceability. Is to provide.

  A communication management apparatus according to one aspect of the present invention is a communication management apparatus that is connected to a network and manages connection information between a communication detection apparatus and a communication relay apparatus connected to the network. This device is connected to means for referring to a communication record that is detected and held in a communication that matches the detection condition in the communication detection device, and a communication device that has executed communication that matches the detection condition based on the content of the communication record. Means for specifying the connection port of the communication relay device being used, and means for instructing the communication relay device to change the state of the connection port to an unusable state.

  In the communication management apparatus according to the first development mode, the communication relay apparatus includes a relay rule holding unit that represents permission or denial of communication of a connected communication apparatus, and relates to a communication apparatus that has performed communication that meets detection conditions. It is preferable to change the content of the relay rule holding unit from permission to rejection.

  A communication management device according to another aspect of the present invention includes a device connection configuration management unit that manages connection information between a communication detection device connected to a network and a communication relay device, and a communication record related to the communication device included in the communication detection device. A communication record collection analysis unit that identifies a communication device that has collected, analyzed, and executed communication based on the analysis result, and a communication to which the communication device is connected based on information about the communication device specified by the communication record collection analysis unit Communication relay device search unit for specifying a relay device and a connection port of the communication relay device, and a communication relay device connection port blocking unit for instructing the communication relay device to make the specified connection port unusable And comprising.

  In the communication management apparatus according to the second development form, the connection port may be an IP address and a port for connecting the communication apparatus.

  A network system according to an aspect of the present invention includes a communication management device, a communication detection device including a communication recording unit that records communication records, and a communication relay device that connects the communication devices and relays them to the network. .

  A communication blocking method in a network system according to an aspect of the present invention includes a step of managing connection information between a communication detection device connected to a network and a communication relay device, and collecting and analyzing communication records from the communication detection device. A step of identifying a communication device that has performed communication based on the analysis result, a step of retrieving IP address information of each connection port of each communication relay device from all communication relay devices on the network, and the identified communication device Including a step of identifying a communication relay device to which the communication relay is connected and a connection port of the communication relay device, and a step of changing the state of the identified connection port from usable to unusable.

  According to another aspect of the present invention, there is provided a communication blocking method in a network system, wherein a communication management apparatus that manages connection information between a communication detection apparatus and a communication relay apparatus connected to the network is connected to the communication relay apparatus. A method of blocking communication of a connected communication device, and determining a communication device that has executed the detected communication based on the content of a communication record detected in conformity with a detection condition of the communication detection device Specifying a communication relay device to which a communication device that has performed communication is connected and a connection port of the communication relay device; and instructing to change the status of the specified connection port to an unusable state Steps.

  The communication blocking method in the network system according to the first development mode may further include a step of changing the communication of the communication device that has performed communication from permitted to denied regarding the contents of the relay rule in the identified communication relay device.

  According to one aspect of the present invention, a program for a communication management device that manages connection information between a communication detection device and a communication relay device connected to a network is used as a detection condition in the communication detection device. A means for referring to a communication record that is detected and held by matching communication, and identifying a connection port of a communication relay device to which a communication device that has performed communication that meets the detection condition is connected based on the content of the communication record And means for instructing the communication relay apparatus to change the state of the connection port to an unusable state.

  A program according to another aspect of the present invention is connected to a network, and a computer of a communication management apparatus that manages connection information between a communication detection apparatus and a communication relay apparatus connected to the network is connected to the communication relay apparatus. In order to cut off the communication of the communication device, a process for determining the communication device that has executed the detected communication based on the content of the communication record detected by the communication detection device, and the communication to which the communication device that has executed the communication is connected Processing for specifying the relay device and the connection port of the communication relay device, and processing for instructing the communication relay device to change the state of the specified connection port to an unusable state are executed.

  According to the present invention, communication of a communication device that has executed unauthorized communication based on the content of the unauthorized communication record is blocked and the communication device is disconnected. Therefore, since it is not necessary to collect information of all communication devices, the cost for collecting information is low. In addition, there is little possibility that communication of a communication device that is not an attack source connected to the network to be managed is blocked, and a reduction in serviceability is reduced.

  The network system according to the embodiment of the present invention includes a communication management device (10 in FIG. 1), an unauthorized communication detection device (30 in FIG. 1), and a communication relay device (40 in FIG. 1) as TCP / IP (Transmission Control Protocol / Internet Protocol) network (20 in FIG. 1). The communication relay device (40 in FIG. 1) relays communication of the communication device (50 in FIG. 1) and connects to the TCP / IP network (20 in FIG. 1). The communication management device (10 in FIG. 1) includes a device connection configuration management unit (11 in FIG. 1), an unauthorized communication record collection / analysis unit (12 in FIG. 1), a communication relay device search unit (13 in FIG. 1), and a communication relay. It includes a device connection port blocking part (14 in FIG. 1). The device connection configuration management unit (11 in FIG. 1) connects the unauthorized communication detection device (30 in FIG. 1) and the communication relay device (40 in FIG. 1) connected to the TCP / IP network (20 in FIG. 1). Manage information. The unauthorized communication record collection / analysis unit (12 in FIG. 1) collects and analyzes the unauthorized communication records held by the unauthorized communication detection device (30 in FIG. 1) managed by the device connection configuration management unit (11 in FIG. 1). Then, the communication device that has performed unauthorized communication is identified. The communication relay device search unit (13 in FIG. 1) is connected to the communication relay device and the communication to which the communication device that has performed unauthorized communication with respect to information on the communication device specified by the unauthorized communication record collection analysis unit (12 in FIG. 1) is connected. Identify the connection port of the relay device. The communication relay device connection port blocking unit (14 in FIG. 1) sets the communication relay device connection port detected by the communication relay device search unit (13 in FIG. 1) to an unusable state. (40 in FIG. 1). The communication relay device (40 in FIG. 1) disables the designated connection port status. Here, the unauthorized communication or the unauthorized communication refers to communication that conforms to a predetermined detection condition, specifically, communication that includes data that is content or order that conforms to a predetermined pattern.

  As described above, the communication management device (10 in FIG. 1) determines the device that has executed unauthorized communication based on the content of the unauthorized communication record detected by the unauthorized communication detection device (30 in FIG. 1). The communication relay device (40 in FIG. 1) and the connection port (45 in FIG. 1) to which the device that has performed communication is connected are specified. Then, the communication management device (10 in FIG. 1) changes the detected connection port state to an unusable state. As a result, the communication device that executes unauthorized communication is disconnected from the network, and the spread of damage on the network due to unauthorized communication is prevented. At this time, since the communication management device (10 in FIG. 1) does not collect information of all the communication devices, the cost for collecting information is low. In addition, there is little possibility that communication of a communication device that is not an attack source connected to the network to be managed is blocked, and a reduction in serviceability is reduced. Hereinafter, it will be described in detail with reference to the drawings in accordance with embodiments.

  FIG. 1 is a block diagram showing the configuration of a network system according to the first embodiment of the present invention. In FIG. 1, the network system includes a communication management device 10, a TCP / IP network 20, an unauthorized communication detection device 30, a communication relay device 40, and a communication device 50.

  The communication management device 10 includes a device connection configuration management unit 11, an unauthorized communication record collection / analysis unit 12, a communication relay device search unit 13, and a communication relay device connection port blocking unit 14, and is connected to the TCP / IP network 20.

  The device connection configuration management unit 11 manages connection information with the unauthorized communication detection device 30 connected to the TCP / IP network 20.

  The unauthorized communication record collection / analysis unit 12 collects unauthorized communication records recorded in the unauthorized communication recording unit 31 of the unauthorized communication detection device 30, and executes a communication device based on the collected record information, for example, a communication device. 50 is specified.

  Based on the information on the communication device 50 specified by the unauthorized communication record collection / analysis unit 12, the communication relay device search unit 13 determines the communication relay device 40 to which the communication device 50 is connected and the connection port 45 in the communication relay device 40. Identify. For this identification, for example, MIB (Management Information Base) information of the communication relay device 40 is collected and analyzed. The MIB information is information relating to the structure of the network management information and the database defined by the Internet Engineering Task Force (IETF), which is an Internet standardization organization.

More specifically, the following information is acquired by reading the MIB information of the communication relay device 40.
-Device name-Connection port index identifier-IP address of the communication device connected to the connection port-Connection port usage status (connected / disconnected)

  The communication relay device connection port blocking unit 14 rewrites the MIB information of the communication relay device 40 as necessary based on the information acquired by the communication relay device search unit 13. For example, the “connection port usage state” information is rewritten from “connected” to “disconnected”. By this rewriting, communication using the connection port 45 of the communication relay device 40 becomes impossible, and as a result, communication of the communication device 50 is cut off. At this time, even if the communication device 50 is connected to the connection port 45 of the communication relay device 40, communication itself becomes impossible. Therefore, from the viewpoint of the user of the communication device 50, since the corresponding communication relay device 40 cannot be used even though the communication device 50 is connected, it appears as if it is physically blocked. Become.

  The unauthorized communication detection device 30 has an IP address 32 and is connected to the TCP / IP network 20. The unauthorized communication detection device 30 also includes an unauthorized communication recording unit 31 that records unauthorized communication records.

Here, the unauthorized communication record recorded in the unauthorized communication recording unit 31 is assumed to be an IDS (Intrusion Detection System) log. The unauthorized communication detection device 30 monitors data (packets) passing through the communication relay device 40. If the data content or order is the content or order that matches the pattern (for example, signature) of the unauthorized communication detection device 30, for example, the unauthorized communication recording unit 31.
・ Attack pattern identifier ・ Attack pattern name ・ Unauthorized communication detection device name that detected communication regarded as an attack ・ IP address of a device generating communication regarded as an attack ・ IP address of a device regarded as an attack destination

  The communication management apparatus 10 collects and monitors the information of the unauthorized communication recording unit 31 as described above. The communication management device 10 first checks the “unauthorized communication detection device name that has detected communication regarded as an attack” and confirms whether or not the unauthorized communication record of the unauthorized communication detection device to be managed is recorded. If it is an unauthorized communication record of the corresponding device, it is determined whether or not it is necessary to block the connection port by looking at the “attack pattern name”. When it is determined that it is necessary to block, the MIB information or the like related to the connection port is acquired by the procedure described above, and the connection port is blocked. Note that the communication management apparatus 10 may be configured to incorporate a computer and a program and to function by the computer executing the program.

  The communication relay device 40 is a device having a switching function connected to the TCP / IP network 20, and has a connection port 45 for relaying communication of other communication devices. The connection port 45 has an IP address 42 and is a port for connecting a communication device. Specifically, it has information on the IP address and each connection port as shown in FIG. In the example of FIG. 2, the communication relay device 40 has an IP address 41 and 16 connection ports, of which the connection port 45 has an IP address 42 and the subnet mask is 255.255.255.0. , Indicating that it is in a usable state. In FIG. 2, only the information of the connection port 45 is shown, but the same information is also expressed for the other connection ports. In FIG. 1, only one communication relay device 40 is shown, but a plurality of communication relay devices 40 may exist.

  The communication device 50 has an IP address 51, is connected to the connection port 45 of the communication relay device 40, and is connected to the TCP / IP network 20 via the communication relay device 40. It is assumed that a similar communication device (not shown) is connected to the connection port 45 of the communication relay device 40 or another connection port. Here, it is assumed that the communication device 50 performs unauthorized communication to a device other than itself connected to the TCP / IP network 20.

  Next, the operation of the communication management apparatus according to the first embodiment of the present invention will be described. FIG. 3 is a flowchart showing the operation of the communication management apparatus according to the first embodiment of the present invention. Here, it is assumed that the communication device 50 performs unauthorized communication, and the unauthorized communication detection device 30 detects unauthorized communication and records it in the unauthorized communication recording unit 31 as an unauthorized communication record. Further, it is assumed that the apparatus connection configuration management unit 11 manages connection information among the TCP / IP network 20, the unauthorized communication detection apparatus 30, the communication relay apparatus 40, and the communication apparatus 50.

  First, the unauthorized communication record collection / analysis unit 12 collects and analyzes unauthorized communication records from the unauthorized communication detection device 30, and specifies the IP address 51 of the communication device 50 that has performed unauthorized communication (step S11).

  Next, the communication relay device search unit 13 selects each connection port as shown in FIG. 2 of each communication relay device from all communication relay devices on the TCP / IP network 20 managed by the device connection configuration management unit 11. The IP address information is searched (step S12). Then, the communication relay device 40 and the connection port 45 to which the communication device 50 specified by the unauthorized communication record collection / analysis unit 12 is connected are specified (step S13).

  Finally, the communication relay device connection port blocking unit 14 changes (blocks) the state of the connection port 45 from usable to unusable for the communication relay device 40 specified by the communication relay device searching unit 13 (step S14). . The connection port 45 is blocked, and the communication device 50 having the IP address 51 cannot communicate using the connection port 45 of the communication relay device 40 (step S15).

  The communication management device 10 operates as described above, finds a device that has performed unauthorized communication based on the content of the unauthorized communication recorded as an attack detected by the unauthorized communication detection device 30, and has performed the attack. The communication relay device 40 to which the device is connected and its connection port 45 are specified. Then, the communication management device 10 changes the detected state of the connection port 45 to an unusable state. As a result, it is possible to prevent the spread of damage on the network due to unauthorized communication.

  FIG. 4 is a block diagram showing the configuration of the network system according to the second embodiment of the present invention. In FIG. 4, the same reference numerals as those in FIG. The network system according to the second embodiment is different from the network system according to the first embodiment in that a communication relay device 40a to which a relay rule holding unit 43 is added is provided instead of the communication relay device 40 of FIG.

  The communication relay device 40a is connected to the TCP / IP network 20, and has a connection port 45 for relaying communication of other communication devices. The connection port 45 has an IP address 42.

  In addition, the communication relay device 40 a holds a relay rule that determines permission / rejection of communication for each connected communication device in the relay rule holding unit 43. Here, the relay rule assumes an ACL (Access Control List). As a specific example, the rule as shown in FIG. 5 is given to each device with a communication (access) authority indicating permission / denial for communication from the device in the communication relay device 40a. For example, the device A connected to the communication relay device 40a is “permitted” and can communicate, but the device B is “rejected” and cannot communicate through the communication relay device 40a. It is shown that. Note that the communication of the communication device 50 is “permitted”.

  Next, the operation of the communication management apparatus according to the second embodiment of the present invention will be described. FIG. 6 is a flowchart showing the operation of the communication management apparatus according to the second embodiment of the present invention. In FIG. 6, steps denoted by the same reference numerals as those in FIG. 3 represent the same processing contents, and description thereof is omitted.

  In step 17, the communication relay device connection port blocking unit 14 does not allow the content of the relay rule holding unit 43 of the communication relay device 40 a specified by the communication relay device search unit 13 because the communication of the communication device 50 is permitted (rejection). To change). By changing to “reject”, the communication device 50 having the IP address 51 becomes unable to communicate using the communication relay device 40a.

  In general, communication from a communication device connected to the communication relay device 40a can be blocked by making the connection port unusable. However, there is only one connection port that cannot be used, and the other connection port may be used and nothing may be connected. . Therefore, in such a case, when a communication device whose communication is interrupted reconnects to a usable connection port different from the unusable connection port of the communication relay device 40a, communication is performed as a result. It cannot be blocked.

  However, the relay rule as described above is applied, and the rule for the corresponding communication device is set to “reject”. By setting in this way, even when the connection port is changed and communication is attempted, communication is rejected by the relay rule, and as a result, communication from the corresponding communication device can be blocked.

1 is a block diagram showing a configuration of a network system according to a first example of the present invention. It is a figure showing the information regarding the IP address and each connection port about a communication relay apparatus. It is a flowchart showing operation | movement of the network system which concerns on 1st Example of this invention. It is a block diagram which shows the structure of the network system which concerns on 2nd Example of this invention. It is a figure which shows the structural example of a relay rule. It is a flowchart showing operation | movement of the network system which concerns on 2nd Example of this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 Communication management apparatus 11 Device connection structure management part 12 Unauthorized communication record collection analysis part 13 Communication relay apparatus search part 14 Communication relay apparatus connection port blocking part 20 TCP / IP network 30 Unauthorized communication detection apparatus 31 Unauthorized communication recording parts 32, 41, 42, 51 IP address 40, 40a Communication relay device 43 Relay rule holding unit 45 Connection port 50 Communication device

Claims (11)

A communication management device that is connected to a network and manages connection information between a communication detection device and a communication relay device connected to the network,
Means for referring to a communication record that is detected and held in the communication detecting device for detecting a communication that meets a detection condition;
Based on the content of the communication record, means for identifying a connection port of a communication relay device to which a communication device that has performed communication that meets the detection condition is connected;
Means for instructing the communication relay device to change the state of the connection port to an unusable state;
A communication management device comprising:   The communication relay device includes a relay rule holding unit indicating that communication of a connected communication device is permitted or denied, and permits the contents of the relay rule holding unit related to a communication device that has executed communication that meets the detection condition. The communication management apparatus according to claim 1, wherein the communication management apparatus is changed from refusal to rejection. A device connection configuration management unit for managing connection information between a communication detection device and a communication relay device connected to the network;
Collecting and analyzing communication records related to communication devices included in the communication detection device, and identifying a communication device that has performed communication based on the analysis result; and
Based on information related to the communication device identified by the communication record collection and analysis unit, a communication relay device to which the communication device is connected and a communication relay device search unit that identifies a connection port of the communication relay device;
A communication relay device connection port blocking unit that instructs the communication relay device to make the specified connection port unusable;
A communication management device comprising:   The communication relay device includes a relay rule holding unit that represents permitting or rejecting communication of a connected communication device, and the communication relay device connection port blocking unit relates to a communication device that has performed communication based on the analysis result 4. The communication management apparatus according to claim 3, wherein the contents of the relay rule holding unit are changed from permitted to denied.   4. The communication management device according to claim 1, wherein the connection port has an IP (Internet Protocol) address and is a port for connecting a communication device. The communication management device according to any one of claims 1 to 5,
The communication detection device comprising a communication recording unit for recording the communication record;
Connecting the communication device and relaying to the network, the communication relay device;
A network system comprising: Managing connection information between a communication detection device and a communication relay device connected to the network;
Collecting and analyzing communication records from the communication detection device, identifying a communication device that has performed communication based on the analysis result; and
Searching IP (Internet Protocol) address information of each connection port of each communication relay device from all communication relay devices on the network;
Identifying the communication relay device to which the identified communication device is connected and the connection port of the communication relay device;
Changing the state of the identified connection port from usable to unusable;
A communication blocking method in a network system, comprising: A communication management device that is connected to a network and manages connection information between a communication detection device and a communication relay device connected to the network is a method of blocking communication of the communication device connected to the communication relay device,
Determining the communication device that has executed the detected communication based on the content of the communication record detected in conformity with the detection condition of the communication detection device;
Identifying a communication relay device to which the communication device that has performed the communication is connected and a connection port of the communication relay device;
Instructing to change the state of the identified connection port to an unusable state;
A communication blocking method in a network system, comprising:   The communication in the network system according to claim 7 or 8, further comprising a step of changing the communication of the communication device that has performed the communication from permission to rejection regarding the contents of the specified relay rule in the communication relay device. Blocking method. A computer of a communication management apparatus that is connected to a network and manages connection information between a communication detection apparatus and a communication relay apparatus connected to the network,
Means for referring to a communication record that is detected and held in the communication detecting device for detecting a communication that meets a detection condition;
Based on the content of the communication record, means for identifying a connection port of a communication relay device to which a communication device that has executed communication that meets the detection condition is connected;
Means for instructing the communication relay device to change the state of the connection port to an unusable state;
Program to function as. In order for the computer of the communication management device that is connected to the network and manages the connection information between the communication detection device connected to the network and the communication relay device to block communication of the communication device connected to the communication relay device,
Based on the content of the communication record detected by the communication detection device, a process for determining the communication device that has executed the detected communication;
A process for identifying a communication relay device to which the communication device that has performed the communication is connected and a connection port of the communication relay device;
Processing for instructing the communication relay device to change the state of the identified connection port to an unusable state;
A program for running.

Images