JP2015142324A - Information sharing device, information sharing method, and information sharing program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To identify service such as an application to be a cause of cyber attack.SOLUTION: An information sharing device is included in each system in a communication system and refers to identification information on an attack source terminal to identify a system accommodating the terminal. When having identified the system including the information sharing device as the system accommodating the attack source terminal and the attack source terminal uses service of another system, the information sharing device transmits attack information to the other system. When the system is not the identified system, the information sharing device transmits attack information to the identified system. An information sharing device included in a system, in the case of receiving attack information from another information sharing device and the system provides service for an attack source terminal, identifies the service as an attack cause.

Description

  The present invention relates to an information sharing apparatus, an information sharing method, and an information sharing program.

  Due to the high functionality of mobile terminals and the diversification of networks, mobile terminals may be used as cyber attack source terminals (see Non-Patent Documents 1 and 2).

Adrienne Porter Felt et al., “A Survey of Mobile Malware in the Wild”, 2011 Aubrey-Derrick Schmidt et al., “Smartphone Malware Evolution Revisited: Android Next Target?”, 2009

  When such an attack occurs, only the identification information of the network space such as the IP (Internet Protocol) address and MAC (Media Access Control) address of the terminal of the attack source can be specified as the attack source information. For this reason, when the application used in the terminal is the cause of the attack, there is a problem that it is difficult to identify the cause. Accordingly, an object of the present invention is to solve the above-described problems and to quickly identify the cause of a cyber attack.

  In order to solve the above-described problem, the present invention provides an input unit that receives input of attack information including identification information of an attack source terminal, and identification information of a system in which the terminal is accommodated for each terminal identification information. The system information shown, the system interconnection information indicating the system in which the terminal of the own system, which is the system to which the information sharing apparatus belongs, receives service, and other systems connected to the own system, For each terminal identification information, referring to the storage unit that stores the provided service information indicating the identification information of the service provided to the terminal, the identification information of the terminal of the attack source and the belonging system information, Refers to the system interconnection information when the identified system is the own system and the belonging system identification unit that identifies the system in which the terminal is accommodated. A determination unit that determines whether the attack source terminal is provided with a service of another system; and when the specified system is not a local system, the specified system is referred to as the attack information. When the identified system is its own system and it is determined that the terminal of the attack source is provided with the service of another system, refer to the system interconnection information. Then, a sharing destination determination unit that determines a system that provides the service as a sharing destination of the attack information, a shared information transmission unit that transmits the attack information to the determined sharing destination, and the input unit Then, when receiving the attack information input from another information sharing device, the server providing the attack source terminal with reference to the attack information and the provided service information. From the scan, characterized in that it comprises a cause analyzer for identifying a service that causes the attack.

  According to the present invention, the cause of a cyber attack can be quickly identified.

FIG. 1 is a diagram illustrating a configuration example of a communication system. FIG. 2 is a diagram illustrating an example of processing of the communication system of FIG. FIG. 3 is a diagram illustrating an example of processing of the communication system of FIG. FIG. 4 is a functional block diagram of the information sharing apparatus of FIG. FIG. 5 is a diagram illustrating an example of the belonging system information in FIG. FIG. 6 is a diagram illustrating an example of the service provider system information in FIG. FIG. 7 is a diagram showing an example of the system interconnection information of FIG. FIG. 8 is a diagram illustrating an example of the identification information conversion table of FIG. FIG. 9 is a diagram illustrating an example of the provided service information in FIG. FIG. 10 is a flowchart showing a processing procedure of the information sharing apparatus of FIG. FIG. 11 is a flowchart showing a processing procedure of the information sharing determination process of FIG. FIG. 12 is a flowchart showing a processing procedure of the information sharing destination determination process of FIG. FIG. 13 is a flowchart illustrating a processing procedure of cause analysis processing. FIG. 14 is a diagram for explaining a specific example of the cause analysis process. FIG. 15 is a diagram illustrating a computer that executes an information sharing program.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. In addition, this invention is not limited by this embodiment.

(First embodiment)
The configuration of the communication system of each embodiment will be described with reference to FIG. The communication system is composed of a plurality of provider systems, and provides, for example, a service provider system that provides various Web services and a communication service using a mobile communication network to the terminal 20 (for example, a mobile phone). A mobile communication provider system; and an application distribution provider system that provides a service such as distribution of an application (hereinafter, abbreviated as an application as appropriate) to the terminal 20.

  The service provider system is a system that provides a service using a Web server such as the server 30 or provides an Internet connection service using an Internet network. This service provider system includes an Internet network, a server 30 connected to the Internet network, and the like.

  The system of the mobile communication carrier includes a mobile communication network such as 3G (third generation mobile communication system) or LTE (Long Term Evolution), and the mobile communication network provides communication services for the terminals 20 (20A to 20C, etc.). provide.

  The system of the application distribution company includes a server 40 that provides services such as application distribution to the terminal 20. The server 40 is an application distribution server that distributes various applications (application A, application B, etc.) to the terminal 20, for example.

  Each of these systems includes a monitoring device 60, a security management device 50, and an information sharing device 10 (10A to 10C), which are connected by a network such as the Internet. The control device 70 indicated by a broken line may or may not be equipped with the system, and will be described later.

  The monitoring device 60 monitors devices and networks in its own system, and when an attack is detected, transmits the attack information indicating the attack content to the security management device 50.

  The security management device 50 transmits the attack information received from the monitoring device 60 to the information sharing device 10. The security management device 50 may accumulate attack information transmitted from the monitoring device 60 or the information sharing device 10 and output the attack information based on an instruction input from a system administrator or the like. Good.

  The information sharing device 10 receives attack information via the security management device 50. As described above, the attack information is information indicating the attack content of the cyber attack, and includes identification information of the terminal 20 of the attack source. This attack information may include identification information of the attack destination terminal 20, an attack type, an attack date and time, and the like. Then, the information sharing device 10 determines whether or not the attack information should be shared with the information sharing device 10 of another system from the content of the received attack information. To other systems.

  For example, consider a case where a DDoS attack (Distributed Denial of Service attack) on the server 30 is detected in the service provider's system. In this case, in the information sharing apparatus 10A, from the received attack information, the terminal 20 that is the source of the attack on the server 30 is the terminals 20A and 20B, and the system to which these terminals 20A and 20B belong (the system of the mobile communication carrier) Identify. Then, the information sharing apparatus 10A transmits this attack information to the information sharing apparatus 10B of the mobile communication carrier system.

  The information sharing apparatus 10B that has received the attack information from the information sharing apparatus 10A checks whether or not there is a service (application) of another system used by the attack source terminals 20A and 20B. If there is a service, attack information is transmitted to the system that provides the service. For example, when the terminals 20A and 20B use the service of the application distributor (application distribution by the server 40), the attack information is transmitted to the information sharing apparatus 10C of the system of the application distributor.

  The information sharing apparatus 10C that has received the attack information from the information sharing apparatus 10B identifies the application (for example, the application A) distributed to these terminals 20 from the identification information of the attack source terminals 20A and 20B included in the attack information. To do. Then, the distribution of this application is stopped.

  The above process will be described in detail with specific examples. For example, as shown in FIG. 2, application A including malware is distributed from the server 40 of the application distributor to the terminals 20A and 20B ((1) distribution of application A (malware)). Let us consider a case where an attack on the server 30 is performed ((2) attack). In this case, the information sharing apparatus 10A of the service provider system that detected the attack transmits the attack information to the mobile communication provider system in which the terminals 20A and 20B are accommodated ((3) attack information). This attack information includes, for example, an attack destination address (the address of the server 30) and an attack source address (the addresses of the terminals 20A and 20B).

  The information sharing apparatus 10B of the mobile carrier's system uses the attack source addresses (for example, the IP addresses of the terminals 20A and 20B) included in the received attack information to determine the terminal numbers (for example, mobile phones) of the attack source terminals 20A and 20B. Phone number) ((4) specify number). Then, the information sharing apparatus 10B identifies the system of the provider of the application used by the terminals 20A and 20B from the terminal number, and the number information (terminal number) of the terminals 20A and 20B is identified with respect to the identified system. ) Is transmitted ((5) number information).

  The information sharing apparatus 10C of the application distributor's system specifies the application (application A) distributed to the terminals 20A and 20B from the received number information ((6) specifies the application).

  Thereafter, for example, as shown in FIG. 3, the application A is deleted from the server 40 in the system of the application distribution company, or the communication from the terminals 20A and 20B is blocked (attack blocking) in the system of the mobile communication company. Or a countermeasure such as instructing the terminals 20A and 20B to delete the application A is taken.

  In this way, even when a cyber attack occurs due to a service provided to the terminal 20 (for example, distribution of an application, etc.), the service and the terminal 20 that cause the attack can be quickly and efficiently performed. Can respond.

  Next, the information sharing apparatus 10 of each system will be described with reference to FIG.

  The information sharing apparatus 10 includes an input / output unit (input unit and output unit) 11, a storage unit 12, and a control unit 13.

  The input / output unit 11 is responsible for inputting various information to the information sharing apparatus 10 and outputting various information from the information sharing apparatus 10. For example, the input / output unit 11 receives input of attack information from the security management device 50 in the system, or outputs attack information to other information sharing devices 10. The input / output unit 11 is realized by an interface for inputting / outputting information and communicating with an external device.

  The storage unit 12 stores belonging system information, service provider system information, system interconnection information, an identification information conversion table, and provided service information. The storage unit 12 is realized by storage means such as a RAM (Random Access Memory) or an HDD (Hard Disk Drive).

  The affiliation system information is information indicating the identification information of the system in which the terminal is accommodated for each identification information (for example, IP address) of the terminal 20. This belonging system information includes not only the identification information of the terminal 20 of the own system (the system to which the own information sharing apparatus 10 belongs) but also the identification information of the terminal 20 of another system connected to the own system. For example, in the affiliation system information shown in FIG. 5, the system in which the terminal 20 with the IP address “aaa” is accommodated (belongs to) is the system of “service provider (ISP) A”, and the IP address is “bbb”. "Indicates that the system in which the terminal 20 is accommodated is a system of" mobile carrier B ".

  The service provider system information is information indicating identification information of the service provider system when the terminal 20 accommodated in the own system uses a service of another system. For example, in the service provider system information shown in FIG. 6, the provider of the service (for example, application) used by the terminal 20 whose IP address is “bbb” is the system of “application distributor C”. It shows that the provider of the service used by the terminal 20 whose IP address is “ccc” is the system of “application distributor D”.

  The system interconnection information is information indicating a system that provides a service to the terminal 20 of the own system and other systems connected to the own system. For example, the system interconnection information indicated by reference numeral 102 in FIG. 7 connects the service provider A system (for example, the Internet network) and the mobile communication provider B system (for example, the mobile communication network) to each other. It shows that. Moreover, it shows that the system of the mobile communication carrier B and the system (for example, the application delivery server) of the application delivery provider C are connected to each other.

  In the system interconnection information illustrated in FIG. 7, when the interconnected systems provide services of the same layer, the systems are arranged at the same height to provide services of different layers. If so, place each system at a different height. For example, FIG. 7 shows that the service provider A system and the mobile communication provider B system provide the same layer of service (communication service). Further, it is shown that the system of the application distribution provider C provides an upper layer service (application distribution service) as viewed from the mobile communication provider B system.

  The identification information conversion table is information indicating the identification information of the terminal 20 accommodated in the own system and the identification information in another system of the terminal 20 in association with each other. For example, consider a case where the identification information of the terminal 20 used in the own system is an IP address, and the identification information of the terminal 20 used in another system is a terminal number. In such a case, the identification information conversion table is information indicating the terminal number corresponding to the IP address for each IP address of the terminal 20 accommodated in the own system, as shown in FIG. The identification information conversion table shown in FIG. 8 indicates that the terminal number of the terminal 20 whose IP address is “bbb” is “ddd”. By providing such an identification information conversion table, for example, when the terminal 20 is a mobile phone, an IP address is used as the identification information of the terminal 20 in a system of a service provider that performs communication using IP such as ISP, In the system of the mobile communication carrier, identification information can be converted even when a terminal number (telephone number or the like) is used.

  The provided service information is information indicating identification information of a service provided to the terminal 20 for each identification information of the terminal 20. For example, the provided service information illustrated in FIG. 9 indicates the provided service information when the service provided by the own system is application distribution. The provided service information shown in FIG. 9 indicates identification information (identification information of the distributed application) of the service provided to the terminal 20 for each terminal number of the terminal 20. For example, the provided service information illustrated in FIG. 9 indicates that “application A” has been distributed to the terminal 20 with the terminal number “ddd”.

  Next, the control unit 13 in FIG. 4 will be described. The control unit 13 includes an affiliation system identification unit 130, an information sharing determination unit (determination unit) 131, a sharing destination determination unit 132, a shared information transmission unit 133, a conversion unit 134, and a cause analysis unit 135. About the shared information determination part 136 shown with a broken line, the case where it equips with the case where the control part 13 equips and the case where it equips is mentioned later. The control unit 13 is realized by a program execution process by a CPU (Central Processing Unit) included in the information sharing apparatus 10 and dedicated hardware.

  The affiliation system specifying unit 130 specifies the system in which the terminal 20 is accommodated based on the identification information of the attacking terminal 20. Specifically, the affiliation system specifying unit 130 refers to the identification information of the attack source terminal 20 and the affiliation system information (see FIG. 5) included in the attack information received via the input / output unit 11, and Identify the system in which 20 is housed. For example, the affiliation system specifying unit 130 refers to the affiliation system information (see FIG. 5) based on the IP address of the attack source terminal 20 and specifies which system the terminal 20 is accommodated in.

  The information sharing determination unit 131 determines whether to share the received attack information with the information sharing apparatus 10 of another system. Specifically, the information sharing determination unit 131 first determines whether or not the system specified by the affiliation system specifying unit 130 is its own system. When the identified system is another system, and when the identified system is its own system, but the attack source terminal 20 uses the service of another system, information on the other system It is determined that information is shared with the sharing apparatus 10, that is, attack information is transmitted. Whether or not the attack source terminal 20 uses a service of another system is determined with reference to, for example, system interconnection information (see FIG. 7) or service provider system information (see FIG. 6). The

  The sharing destination determination unit 132 determines a sharing destination of attack information. Specifically, when the system specified by the belonging system specifying unit 130 is not the own system, the sharing destination determining unit 132 determines the system as a sharing destination of attack information. That is, when the attack source terminal 20 is not the terminal 20 of the own system, the sharing destination determination unit 132 determines the system accommodated by the attack source terminal 20 as the attack information sharing destination. On the other hand, when the system specified by the affiliation system specifying unit 130 is the local system, when the terminal 20 uses a service of another system, the sharing destination determining unit 132 sets the system that provides the service. Is determined as the sharing destination of attack information. The service provider system used by the terminal 20 is specified with reference to service provider system information (see FIG. 6).

  The shared information transmission unit 133 transmits the attack information to the sharing destination determined by the sharing destination determination unit 132 via the input / output unit 11.

  The conversion unit 134 converts the identification information of the attack source terminal 20 indicated in the attack information as necessary. For example, when the identification information of the attack source terminal 20 included in the attack information received from another system via the input / output unit 11 is not the identification information used in the own system, the identification information conversion table (see FIG. 8) is used. The identification information is converted. As a specific example, the terminal number is used as the identification information of the terminal 20 in the own system. However, when the IP address of the terminal 20 is described in the received attack information, the identification information conversion table is used to The identification information (IP address) of the attack source terminal 20 is converted into a terminal number. Then, the attack information including the identification information (terminal number) of the converted attack source terminal 20 is output to the belonging system specifying unit 130.

  Further, when the shared information transmission unit 133 transmits attack information to the information sharing apparatus 10 of another system, the identification information of the terminal 20 used in the other system may be different from the identification information used in the own system. If it is known, the identification information of the attack source terminal 20 in the attack information may be converted into the identification information of the terminal 20 of another system and output to the shared information transmission unit 133. For example, when the identification information of the terminal 20 used in the own system is an IP address, but the identification information of the terminal 20 used in another system is a terminal number, the attack information is obtained using the identification information conversion table (see FIG. 8). The identification information (IP address) of the attack source terminal 20 is converted into a terminal number. Then, the attack information including the identification information (terminal number) of the converted attack source terminal 20 is output to the shared information transmitting unit 133.

  If the information sharing apparatus 10 does not need to convert the identification information of the terminal 20 with another system, it is not necessary to provide the conversion unit 134 and the identification information conversion table.

  The cause analysis unit 135 analyzes the service (for example, application) that causes the cyber attack with reference to the input attack information and the provided service information (see FIG. 9). For example, the cause analysis unit 135 refers to the identification information (for example, the terminal number) of the attack source terminal 20 indicated in the attack information input via the input / output unit 11 and the provided service information (see FIG. 9). Thus, the application provided to the attack source terminal 20 is specified. Then, the cause analysis unit 135 identifies the application as the cause of the attack. The specified application information is transmitted to, for example, the security management device 50 or transmitted to a terminal device (not shown) of a system administrator. By doing so, the system administrator or the like can know which application caused the attack, and can quickly take countermeasures against the attack.

  Next, the processing procedure of the information sharing apparatus 10 will be described with reference to FIG. First, when the information sharing apparatus 10 receives an input of attack information via the input / output unit 11, the belonging system specifying unit 130 refers to the belonging system information (see FIG. 5), and identifies the attack source included in the attack information. The system of the terminal 20 is specified (S1: belonging system specification).

  Next, the information sharing determination unit 131 determines whether to share attack information with other systems depending on which system is identified in S1 (S2: information sharing determination process). Details of this information sharing determination process will be described later.

  If the information sharing determination unit 131 determines that the attack information is to be shared with other systems as a result of the processing of S2 ("share" in S3), the sharing destination determination unit 132 determines the sharing destination of the attack information (S4: Information sharing destination determination process). Details of this information sharing destination determination process will be described later.

  After S4, the shared information transmission unit 133 transmits the attack information to the sharing destination determined in S4 (S5). Then, the process ends.

  On the other hand, when the information sharing determination unit 131 determines that the attack information is not shared with other systems as a result of the processing of S2 (“do not share” in S3), the cause analysis unit 135 receives the input attack. With reference to the information and the provided service information (see FIG. 9), the service (for example, application) causing the cyber attack is analyzed (S6: cause analysis). For example, the cause analysis unit 135 identifies an application used in the attack source terminal 20. Then, the cause analysis unit 135 ends the process by outputting information on the identified application.

  As described above, when the information sharing apparatus 10 of each system should share the attack information with another system, the information sharing apparatus 10 transmits the attack information to the other system. The cause of the attack is analyzed based on the attack information.

  Next, the information sharing determination process of FIG. 10 will be described in detail with reference to FIG. When the system in which the attack source terminal 20 identified in S1 of FIG. 10 is accommodated is not its own system (No in S11), the information sharing determination unit 131 shares the attack information with other systems. Judgment is made (S12). On the other hand, when the system in which the attack source terminal 20 is accommodated is the own system (Yes in S11), the information sharing determination unit 131 refers to the system interconnection information (see FIG. 7) and refers to the attack source terminal. It is determined whether 20 is using a service of another system (S13). Here, when the attack source terminal 20 uses a service of another system (Yes in S13), the information sharing determination unit 131 transmits the attack information to the other system. It is determined to share (S12). On the other hand, when the attack source terminal 20 does not use the service of another system (No in S13), the information sharing determination unit 131 determines that the attack information is not shared with another system (S14). .

  That is, the information sharing determination unit 131 uses (1) the case where the attack source terminal 20 belongs to another system, and (2) the attack source terminal 20 belongs to the own system, but uses services of other systems. If it is determined that the attack information is shared with other systems.

  Next, the information sharing destination determination process in FIG. 10 will be described in detail with reference to FIG. First, the sharing destination determining unit 132 refers to the system interconnection information (see FIG. 7), and determines whether the sharing destination of the attack information is the same layer system as the own system or a higher layer system (S21). Specifically, the sharing destination determination unit 132 determines whether the system in which the attack source terminal 20 identified by the belonging system identification unit 130 is accommodated is a system in the same layer as its own system, or a service in a higher layer system. Determine whether the system is in use.

  When the sharing destination determining unit 132 determines in S21 that the attack information sharing destination is a system of the same layer (“same layer” in S21), the system specified by the belonging system specifying unit 130 is identified as the sharing destination of the attack information. (S22). On the other hand, when the sharing destination determination unit 132 determines that the sharing destination of the attack information is an upper layer system (“upper layer” in S21), the attack is referred to the service provider system information (see FIG. 6). The system that provides the service used by the original terminal 20 is selected as the attack information sharing destination (S23).

  In other words, the sharing destination determination unit 132 determines the system in which the attack source terminal 20 is accommodated and the service provider system used by the attack source terminal 20 as the attack information sharing destination. Then, the shared information transmitting unit 133 transmits attack information to the determined sharing destination system (specifically, the information sharing apparatus 10 of the system). By doing so, the attack information reaches the system that accommodates the terminal 20 that causes the attack and the system that provides the terminal 20 (for example, distributes the application). The cause of the attack can be identified quickly and efficiently.

(Second Embodiment)
When the cause analysis unit 135 of the information sharing apparatus 10 analyzes the application causing the attack, each application is (the ratio used by the terminal 20 of the attack source) / (all of the communication system). The value (ratio of deviation) used by the terminal 20 may be used. The processing of the cause analysis unit 135 in this case will be described with reference to FIG. In calculating the divergence degree, the information sharing apparatus 10 stores attack information related to attacks that have occurred in the communication system in the past.

  The cause analysis unit 135 refers to the identification information of the attack source terminal 20 included in the accumulated attack information and the provided service information (see FIG. 9), and the application used by each attack source terminal 20 Is extracted (S31).

  After S31, the cause analysis unit 135 calculates the divergence degree for each of the identified applications based on the ratio used by each attack source terminal 20 and the ratio used by all terminals 20 (S32). . That is, the cause analysis unit 135 calculates a value (divergence) of (a ratio used by the attack source terminal 20) / (a ratio used by each terminal 20 including the attack source terminal 20) for each application. calculate. Then, the cause analysis unit 135 identifies the application having the highest degree of divergence as the cause of the attack (S33).

  By doing in this way, an application with a high ratio currently used in the terminal 20 of the attack origin can be specified as a cause of an attack with respect to the ratio currently used in the terminal 20 whole in a communication system.

  A specific example of such cause analysis processing will be described with reference to FIG. Here, for example, the number of terminals 20 determined to be the attack source terminal 20 in the communication system is 100, of which application B is used by 80 terminals 20 and application C is 60 terminals 20. The case where it is used by is considered. Further, the total number of terminals 20 in the communication system is 100,000. Of these, application B is used for 50,000 terminals 20 and application C is used for 500 terminals 20.

  In such a case, the rate at which the app B is used by the attack source terminal 20 is 80/100 = 80%, and the rate at which the app B is used by all the terminals 20 in the communication system is 5 10,000 units / 100,000 units = 50%. Therefore, the divergence degree of the application B is 80% / 50% = 1.6.

  Further, the rate at which the application C is used by the attacking terminal 20 is 60/100 = 60%, and the rate at which the application C is used by all the terminals 20 in the communication system is 500/10. Ten thousand units = 0.5%. Therefore, the divergence degree of the application C is 60% / 0.5% = 120.

  Therefore, the cause analysis unit 135 identifies the application C having the highest divergence as the cause of the attack with respect to the usage ratio of the entire communication system.

  The cause analysis unit 135 may identify an application having a divergence degree equal to or higher than a predetermined threshold as an attack cause in addition to the application having the highest divergence degree. In addition, the cause analysis unit 135 may specify an application having a high degree of common use in the attack source terminal 20 by using a value other than the divergence degree.

(Other embodiments)
Note that the shared information transmission unit 133 of each of the embodiments described above may transmit attack information received from the information sharing apparatus 10 of another system to the security management apparatus 50 of its own system. By doing in this way, in the security management apparatus 50, the security information regarding the attack caused by the terminal 20 of the own system can be accumulated.

  Note that the information sharing apparatus 10 of each embodiment may further include a shared information determination unit 136 indicated by a broken line in FIG. The shared information determination unit 136 determines the content of attack information shared with the information sharing apparatus 10 of another system. Specifically, the shared information determination unit 136 selects information related to at least one of the identification information of the attack destination terminal 20, the type of attack, and the date and time of attack from the input attack information. Then, the shared information transmission unit 133 transmits the attack information including the information selected by the shared information determination unit 136 to the sharing destination system. It should be noted that the administrator of each system or the like sets, for example, which item of the attack information the shared information determination unit 136 shares with the information sharing apparatus 10 of another system.

  In this way, the administrator of each system can select the contents of attack information shared with other systems. For example, by including not only the identification information of the attack source terminal 20 but also the identification information of the attack destination terminal 20, the type of attack, and the date and time of the attack as attack information shared with other systems It is possible to provide attack information including more information to other systems. In addition, the information sharing apparatus 10 of another system can analyze the cause of the attack based on more information, and the security management apparatus 50 can accumulate more information.

  Note that the system interconnection information (see FIG. 7) held by each information sharing apparatus 10 in each embodiment indicates a connection relationship between all systems between communication systems, as illustrated by reference numeral 102 in FIG. It is not limited to information. For example, you may make it hold | maintain only the information which shows the connection relationship with the system adjacent to a self-system. Specifically, among the system interconnection information shown in FIG. 7, the information sharing apparatus 10A holds the information indicated by reference numeral 101, the information sharing apparatus 10B holds the information indicated by reference numeral 102, and the information sharing apparatus 10C Information indicated by reference numeral 103 may be held.

  Furthermore, the system of each embodiment may include the control device 70 of FIG. The control device 70 performs connection control for a device (for example, the terminal 20) in the own system based on an instruction from the security management device 50. For example, consider a case where the security management device 50 of the system of the mobile communication carrier obtains information that the attack source terminal 20 is the terminals 20A and 20B based on the attack information received by the information sharing device 10B. In this case, the security management device 50 instructs the control device 70 to control connection of the terminals 20A and 20B. Based on this instruction, the control device 70 performs connection control so that the terminals 20A and 20B cannot be connected to the outside via the mobile communication network (see “attack blocking” in FIG. 3). By doing in this way, it can prevent that the damage of the attack by the terminal 20 of the attack origin spreads.

  In addition, when the application that causes the attack is identified, the information sharing apparatus 10 of each embodiment may instruct the server (for example, the server 40) that distributes the application to delete the application. Good. Also by doing this, it is possible to prevent the damage of the attack by the attack source terminal 20 from expanding.

  In each embodiment, the system interconnection information and the service provider system information are described as separate information. However, the contents of the service provider system information may be included in the system interconnection information. In this case, the system that provides the service used by the terminal 20 in each system is specified with reference to the system interconnection information.

(program)
In addition, it is possible to create a program in which processing executed by the information sharing apparatus 10 according to the above embodiment is described in a language that can be executed by a computer. In this case, the same effect as the above-described embodiment can be obtained by the computer executing the program. Further, such a program may be recorded on a computer-readable recording medium, and the program recorded on the recording medium may be read by a computer and executed to execute the same processing as in the above embodiment. Hereinafter, an example of a computer that executes an information sharing program that realizes the same function as the information sharing apparatus 10 will be described.

  As shown in FIG. 15, a computer 1000 that executes an information sharing program includes, for example, a memory 1010, a CPU 1020, a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network. Interface 1070. These units are connected by a bus 1080.

  The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores a boot program such as BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to the hard disk drive 1090. The disk drive interface 1040 is connected to the disk drive 1100. A removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1100, for example. For example, a mouse 1110 and a keyboard 1120 are connected to the serial port interface 1050. For example, a display 1130 is connected to the video adapter 1060.

  Here, as shown in FIG. 15, the hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. Each table described in the above embodiment is stored in the hard disk drive 1090 or the memory 1010, for example.

  Further, the information sharing program is stored in the hard disk drive 1090 as a program module 1093 in which a command executed by the computer 1000 is described, for example. Specifically, a program module describing each process executed by the information sharing apparatus 10 described in the above embodiment is stored in the hard disk drive 1090.

  Data used for information processing by the information sharing program is stored as program data 1094 in, for example, the hard disk drive 1090. Then, the CPU 1020 reads out the program module 1093 and the program data 1094 stored in the hard disk drive 1090 to the RAM 1012 as necessary, and executes the above-described procedures.

  The program module 1093 and the program data 1094 related to the information sharing program are not limited to being stored in the hard disk drive 1090. For example, the program module 1093 and the program data 1094 are stored in a removable storage medium and read by the CPU 1020 via the disk drive 1100 or the like. May be issued. Alternatively, the program module 1093 and the program data 1094 related to the information sharing program are stored in another computer connected via a network such as a LAN (Local Area Network) or a WAN (Wide Area Network), and are transmitted via the network interface 1070. May be read by the CPU 1020.

DESCRIPTION OF SYMBOLS 10 Information sharing apparatus 11 Input / output part 12 Storage part 13 Control part 20 Terminal 30, 40 Server 50 Security management apparatus 60 Monitoring apparatus 70 Control apparatus 130 Affiliated system identification part 131 Information sharing judgment part 132 Sharing destination determination part 133 Shared information transmission part 134 Conversion unit 135 Cause analysis unit 136 Shared information determination unit

Claims (7)

An input unit for receiving input of attack information including identification information of the terminal of the attack source;
For each terminal identification information, belonging system information indicating the identification information of the system in which the terminal is accommodated, a system in which the terminal of the own system, which is a system to which the information sharing apparatus belongs, receives the service, and A storage unit that stores system interconnection information indicating other systems connected to the system, and provided service information indicating identification information of a service provided to the terminal for each identification information of the terminal;
With reference to the identification information of the terminal of the attack source and the affiliation system information, an affiliation system identification unit that identifies a system in which the terminal is accommodated,
When the specified system is its own system, a determination unit that refers to the system interconnection information and determines whether the attack source terminal is provided with a service of another system;
When the identified system is not its own system, the identified system is determined as a sharing destination of the attack information;
When the specified system is its own system, when it is determined that the attack source terminal is provided with the service of another system, the service is provided with reference to the system interconnection information. A sharing destination determination unit that determines an original system as a sharing destination of the attack information;
A shared information transmission unit that transmits the attack information to the determined sharing destination;
Among the services provided to the attack source terminal with reference to the attack information and the provided service information when receiving the attack information input from another information sharing device via the input unit From the cause analysis unit that identifies the service that is causing the attack,
An information sharing apparatus comprising: The storage unit further includes:
For each identification information of the terminal of its own system, further comprising an identification information conversion table showing identification information used in another system connected to the terminal's own system,
The information sharing apparatus further includes:
When the attack source terminal is a terminal of its own system, when receiving the input of the attack information from the other system, the identification information of the attack source terminal is obtained by referring to the identification information conversion table. The information sharing apparatus according to claim 1, further comprising a conversion unit that converts the identification information to be used in the own system. When the cause analysis unit identifies the service causing the attack,
Referring to the attack information and the provided service information, calculate the ratio that the service is provided to the terminal that is the attack source and the ratio that is provided to each terminal including the terminal that is the attack source. The information sharing apparatus according to claim 1, wherein the service that causes the attack is specified based on the calculated ratios. The attack information further includes at least one of identification information of an attack destination terminal, an attack type, and an attack date and time,
4. The information sharing according to claim 1, wherein the shared information transmitting unit further transmits the attack information to a security management apparatus that accumulates security information of the own system. 5. apparatus. The information sharing apparatus further includes:
Among the attack information, comprising a shared information determination unit for selecting information regarding at least one of the identification information of the attack destination terminal, the type of attack, and the date and time of the attack,
5. The information sharing according to claim 4, wherein the shared information transmission unit transmits attack information including identification information of the terminal of the attack source and information of the selected item to the sharing destination. apparatus. An input step for receiving input of attack information including identification information of the terminal of the attack source;
For each terminal identification information, the affiliation system information indicating the identification information of the system in which the terminal is accommodated and the identification information of the attack source terminal are identified to identify the system in which the terminal is accommodated System specific steps;
When the identified system is the own system to which the own information sharing apparatus belongs, the system that shows the system in which the terminal of the own system receives the service and the other system connected to the own system A determination step of referring to connection information to determine whether the attack source terminal is provided with a service of another system;
When the identified system is not the own system, the identified system is determined as a sharing destination of the attack information, and when the identified system is the own system, the attack source terminal is another system. When it is determined that the service is provided, a sharing destination determining step of determining the system that provides the service as a sharing destination of the attack information with reference to the system interconnection information;
A shared information transmission step of transmitting the attack information to the determined sharing destination;
When receiving the attack information input from another information sharing device, for each piece of identification information of the terminal, refer to the provided service information indicating the identification information of the service provided to the terminal and the attack information. A cause analysis step for identifying a service causing the attack from services provided to the attack source terminal;
A computer-executable information sharing method. An input step for receiving input of attack information including identification information of the terminal of the attack source;
For each terminal identification information, the affiliation system information indicating the identification information of the system in which the terminal is accommodated and the identification information of the attack source terminal are identified to identify the system in which the terminal is accommodated System specific steps;
When the identified system is the own system to which the own information sharing apparatus belongs, the system that shows the system in which the terminal of the own system receives the service and the other system connected to the own system A determination step of referring to connection information to determine whether the attack source terminal is provided with a service of another system;
When the identified system is not the own system, the identified system is determined as a sharing destination of the attack information, and when the identified system is the own system, the attack source terminal is another system. When it is determined that the service is provided, a sharing destination determining step of determining the system that provides the service as a sharing destination of the attack information with reference to the system interconnection information;
A shared information transmission step of transmitting the attack information to the determined sharing destination;
When receiving the attack information input from another information sharing device, for each piece of identification information of the terminal, refer to the provided service information indicating the identification information of the service provided to the terminal and the attack information. A cause analysis step for identifying a service causing the attack from services provided to the attack source terminal;
An information sharing program that causes a computer to execute the program.

Images