JP2018097660A - Monitoring server, security countermeasure method and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To take a prompt countermeasure against an illegal access.SOLUTION: A monitoring server includes: a log acquisition unit 110 that acquires an authentication log from an authentication server; an account processing unit 120 that, when account information included in the authentication log acquired by the log acquisition unit 110 is different from a preset one, changes a password used for authentication and notifies the authentication server of the change of the password; and a login processing unit 130 that forcibly logs out an account logged in using the password before the change when the account processing unit 120 changes the password.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a monitoring server, a security countermeasure method, and a program.

In recent years, cyber attacks have become more sophisticated. Detailed log analysis is required to identify this attack. In order to analyze the log in detail, manual log analysis becomes the mainstream, and it takes time to take countermeasures.
Therefore, a system that detects that the terminal device is a misrepresentation terminal based on the difference between the login time and the logout time of the terminal device has been considered (for example, see Patent Document 1).

JP 2009-296510 A

  In the technique described in Patent Document 1, an unauthorized terminal device cannot be detected unless an authorized terminal device is logged out, and an immediate measure cannot be taken against unauthorized access. There is a problem.

  An object of the present invention is to provide a monitoring server, a communication system, a security countermeasure method, and a program that solve the above-described problems.

The monitoring server of the present invention
A log acquisition unit for acquiring an authentication log from the authentication server;
If the account information included in the authentication log acquired by the log acquisition unit is different from that set in advance, the account processing unit for changing the password used for authentication and notifying the change of the password to the authentication server;
And a login processing unit that performs forced logout for an account logged in using the password before the change when the account processing unit changes the password.
A log acquisition unit for acquiring an authentication log from the authentication server;
An account processing unit that determines whether or not the number of times that a login request has been made in a predetermined period from devices to which the same IP address is assigned in the authentication log acquired by the log acquisition unit exceeds a threshold;
When the account processing unit determines that the number of times has exceeded the threshold, the account processing unit includes a login processing unit that rejects a login request from a device to which the IP address is assigned.
Further, the security countermeasure method of the present invention includes:
Processing to obtain the authentication log from the authentication server;
When the account information included in the acquired authentication log is different from that set in advance, a process of changing a password used for authentication;
A process of notifying the authentication server of the password change;
When the password is changed, a process of forcibly logging out an account that is logged in using the password before the change is performed.
In addition, the process of obtaining the authentication log from the authentication server,
In the acquired authentication log, a process of determining whether or not the number of times that a login request is made in a predetermined period from devices to which the same IP address is assigned exceeds a threshold value;
When the number of times exceeds the threshold value, a process of rejecting a login request from a device to which the IP address is assigned is performed.
The program of the present invention is
A program for causing a computer to execute,
The procedure to acquire the authentication log from the authentication server,
If the account information included in the acquired authentication log is different from that set in advance, a procedure for changing the password used for authentication;
A procedure for notifying the authentication server of the change of the password;
When the password is changed, the computer is caused to execute a procedure for forcibly logging out an account logged in using the password before the change.
In addition, the procedure to acquire the authentication log from the authentication server,
In the acquired authentication log, a procedure for determining whether or not the number of log-in requests made in a predetermined period from devices to which the same IP address is assigned exceeds a threshold;
When the number of times exceeds the threshold, the computer is caused to execute a procedure for rejecting a login request from a device to which the IP address is assigned.

  As described above, in the present invention, immediate countermeasures can be taken against unauthorized access.

It is a figure which shows 1st Embodiment of the monitoring server of this invention. 3 is a flowchart for explaining an example of a security countermeasure method in the monitoring server shown in FIG. 1. It is a figure which shows 2nd Embodiment of the monitoring server of this invention. It is a flowchart for demonstrating an example of the security countermeasure method in the monitoring server shown in FIG. It is a figure which shows 3rd Embodiment of the monitoring server of this invention. It is a figure which shows an example of the internal structure of the monitoring server and authentication server which were shown in FIG. It is a sequence diagram for demonstrating the 1st example of the security countermeasure method in the communication system shown in FIG. FIG. 6 is a sequence diagram for explaining a second example of the security countermeasure method in the communication system shown in FIG. 5. It is a sequence diagram for demonstrating the 3rd example of the security countermeasure method in the communication system shown in FIG. It is a figure which shows 4th Embodiment of the monitoring server of this invention. It is a sequence diagram for demonstrating an example of the security countermeasure method in the monitoring server shown in FIG.

Embodiments of the present invention will be described below with reference to the drawings.
(First embodiment)

FIG. 1 is a diagram showing a first embodiment of a monitoring server according to the present invention.
As shown in FIG. 1, the monitoring server 100 in this embodiment includes a log acquisition unit 110, an account processing unit 120, and a login processing unit 130. FIG. 1 shows an example of main components related to the present embodiment among the components included in the monitoring server 100 of the present invention.

The log acquisition unit 110 acquires an authentication log from an authentication server connected to the monitoring server 100.
If the account information included in the authentication log acquired by the log acquisition unit 110 is different from that set in advance, the account processing unit 120 changes the password used for authentication. The account processing unit 120 notifies the authentication server of the password change.
When the account processing unit 120 changes the password, the login processing unit 130 performs forced logout on the account that is logged in using the password before the change.

  Hereinafter, a security countermeasure method in the monitoring server 100 shown in FIG. 1 will be described. FIG. 2 is a flowchart for explaining an example of the security countermeasure method in the monitoring server 100 shown in FIG.

First, the log acquisition unit 110 acquires an authentication log from the authentication server (step S1). Subsequently, when the account information included in the acquired authentication log is different from that set in advance, the account processing unit 120 changes the password used for authentication (step S2). When changing the password, the account processing unit 120 notifies the authentication server of the password change (step S3).
When the account processing unit 120 changes the password, the login processing unit 130 determines whether there is an account logged in using the password before the change (step S4). If there is an account logged in using the password before change, the login processing unit 130 performs forced logout on the account (step S5).

As described above, when the account included in the authentication log is an unexpected one, the monitoring server 100 changes the password used for authentication, and performs forced logout on the account that is logged in using the password before the change. carry out. Therefore, immediate countermeasures can be taken against unauthorized access.
(Second Embodiment)

FIG. 3 is a diagram showing a second embodiment of the monitoring server of the present invention.
As shown in FIG. 3, the monitoring server 101 in this embodiment includes a log acquisition unit 111, an account processing unit 121, and a login processing unit 131. FIG. 3 shows an example of main components related to the present embodiment among the components included in the monitoring server 101 of the present invention.

The log acquisition unit 111 acquires an authentication log from an authentication server connected to the monitoring server 101.
In the authentication log acquired by the log acquisition unit 111, the account processing unit 121 determines whether or not the number of login requests made in a predetermined period from devices assigned the same IP (Internet Protocol) address exceeds a threshold value. Determine.
In the login processing unit 131, the number of times that the account processing unit 121 has made a login request in a predetermined period from devices assigned the same IP address in the authentication log acquired by the log acquisition unit 111 exceeds the threshold. If it is determined that the login request is received, the login request from the device to which the IP address is assigned is rejected.

  The security countermeasure method in the monitoring server 101 shown in FIG. 3 will be described below. FIG. 4 is a flowchart for explaining an example of the security countermeasure method in the monitoring server 101 shown in FIG.

  First, the log acquisition unit 111 acquires an authentication log from the authentication server (step S11). Subsequently, the account processing unit 121 counts the number of times login requests are made from devices to which the same IP address is assigned within a preset period in the authentication log acquired by the log acquisition unit 111. (Step S12). The account processing unit 121 determines whether or not the counted number exceeds a preset threshold (step S13). If the number of times counted by the account processing unit 121 exceeds the threshold, the login processing unit 131 rejects a login request from the device to which the IP address is assigned (step S14).

As described above, based on the authentication log, the monitoring server 101 rejects a log-in request from a device to which the same IP address is assigned when a log-in request exceeds a threshold value for a predetermined period. Therefore, immediate countermeasures can be taken against unauthorized access.
(Third embodiment)

FIG. 5 is a diagram showing a third embodiment of the monitoring server of the present invention.
As shown in FIG. 5, the monitoring server 102 in this embodiment is connected to an authentication server 202, user terminals 302-1 to 302-3, and a communication network 502. The monitoring server 102 is connected to the communication device 402 via the communication network 502. FIG. 5 shows an example in which the number of user terminals is three, but the number is not limited.
User terminals 302-1 to 302-3 are communication terminals owned and operated by a user (client).
The communication device 402 is a communication device to which the user terminals 302-1 to 302-3 are connected via the communication network 502, and provides a predetermined service to the user terminals 302-1 to 302-3.

  FIG. 6 is a diagram illustrating an example of an internal configuration of the monitoring server 102 and the authentication server 202 illustrated in FIG.

  As illustrated in FIG. 6, the monitoring server 102 illustrated in FIG. 5 includes a log acquisition unit 112, an account processing unit 122, a login processing unit 132, and a RADIUS client processing unit 142. FIG. 6 shows an example of main components related to the present embodiment among the components included in the monitoring server 102 of the present invention.

The log acquisition unit 112 acquires an authentication log from the log DB 212 provided in the authentication server 202. Specifically, the log acquisition unit 112 uses, as an authentication log, an authentication request account name, account authority, authentication result, request time, request source IP address, account information update request (account new registration, deletion, authority Change, password change, etc.) request source IP address, account that requested the assignment of privilege, and the like.
If the account information included in the authentication log acquired by the log acquisition unit 112 is different from that set in advance, the account processing unit 122 changes the password used for authentication. The account processing unit 122 notifies the authentication server 202 of the password change. Specifically, the account processing unit 122, when the IP address of the event request source included in the account information included in the authentication log acquired by the log acquisition unit 112 is not included in the preset account information, change the password. Alternatively, when the account processing unit 122 does not include the account of the request source of the request event for privilege assignment included in the account information included in the authentication log acquired by the log acquisition unit 112 in the preset account information ,change the password. More specifically, the account processing unit 122 includes the account information update request source IP address included in the account information included in the authentication log acquired by the log acquisition unit 112 in the preset account information. If not, change the password. Alternatively, the account processing unit 122, when the IP address of the request source of the authentication request included in the account information included in the authentication log acquired by the log acquisition unit 112 is not included in the preset account information, To change.
When the account processing unit 122 changes the password, the login processing unit 132 performs forced logout on the account that is logged in using the password before the change. That is, the login processing unit 132 is a component that performs cyber countermeasure processing.
The RADIUS Client processing unit 142 performs a RADIUS authentication protocol process with the RADIUS Server processing unit 242 provided in the authentication server 202. The RADIUS client processing unit 142 has a privileged account list and registers privileged accounts in the list. The RADIUS Client processing unit 142 has an administrator terminal IP address list, and registers the IP address of the communication terminal used by the administrator in the list. When changing the IP address of the communication terminal that uses the administrator account, the RADIUS Client processing unit 142 also updates the administrator terminal IP address list of the monitoring server 102. The function of the RADIUS client processing unit 142 described above may be executed by the account processing unit 122.
The monitoring server 102 also has a function of restricting communication terminals used by the administrator and assigning a fixed IP address to the communication terminals.

  As illustrated in FIG. 6, the authentication server 202 illustrated in FIG. 5 includes a log DB 212, an account management unit 222, a login processing unit 232, and a RADIUS server processing unit 242.

The log DB 212 is a database that stores an authentication log. This authentication log is as described above.
The account management unit 222 manages accounts that can be authenticated. The account management unit 222 stores this account in a memory or the like.
The login processing unit 232 performs login processing of the authenticated client (user terminal).
The RADIUS server processing unit 242 performs a RADIUS authentication protocol process with the RADIUS client processing unit 142 included in the monitoring server 102.

  The security countermeasure method in the communication system shown in FIG. 5 will be described below. FIG. 7 is a sequence diagram for explaining a first example of the security countermeasure method in the communication system shown in FIG. Note that the “user terminal” illustrated in FIG. 7 may be any of the user terminals 302-1 to 302-3 illustrated in FIG. The same applies to FIGS. 8, 9, and 11 below.

Here, the attacker (the communication terminal operated by the attacker) adds or changes the account of the monitoring server 102 and the communication device 402 to the authentication server 202 by using the administrator account information obtained illegally. The state is assumed. The log of this process is stored in the log DB 212 of the authentication server 202.
The log acquisition unit 112 of the monitoring server 102 acquires an authentication log from the log DB 212 (step S21). Acquisition of this authentication log is performed periodically. Subsequently, the account processing unit 122 analyzes the authentication log acquired by the log acquisition unit 112 (step S22). Specifically, for the account information update event (login, password update event), the account processing unit 122 sets the IP address of the event request source included in the account information to the administrator terminal IP set in advance. Determine if it exists in the address list.
If the IP address of the event request source included in the account information does not exist in the administrator terminal IP address list, the account processing unit 122 changes the password of the account (administrator) and notifies the authentication server 202 to that effect. Notification is made (step S23). Upon receiving the administrator password change notification, the authentication server 202 validates the administrator password change notification (step S24).
Further, the account processing unit 122 instructs the authentication server 202 to add an authentication request using the password before the change to the authentication disabling list as authentication impossible (step S25). When the authentication server 202 receives an instruction to add to the unauthenticable list, the authentication server 202 updates the unauthenticated list based on the addition (step S26).
After the account processing unit 122 changes the password, the login processing unit 132 performs a forced logout for the account logged in to the communication device 402 using the password before the change (step S27).
Thereafter, when the attacker logs in to the communication device 402 using the password before the change, forced logout is performed (step S28). Similarly, when an attacker logs in to the monitoring server 102 using the password before the change, forced logout is performed (step S29).
Thereafter, when the user terminal logs in the administrator to the authentication server 202 (step S30), the authentication server 202 notifies the user terminal of the password change (step S31).

  FIG. 8 is a sequence diagram for explaining a second example of the security countermeasure method in the communication system shown in FIG.

Here, it is assumed that the internal criminal (the communication terminal operated by the internal criminal) grants privileges to the authentication server 202 with respect to a known account (requester account that has requested allocation). The log of this process is stored in the log DB 212 of the authentication server 202. The privilege is the authority of the security administrator, such as managing user rights.
The log acquisition unit 112 of the monitoring server 102 acquires an authentication log from the log DB 212 (step S41). Acquisition of this authentication log is performed periodically. Subsequently, the account processing unit 122 analyzes the authentication log acquired by the log acquisition unit 112 (step S42). Specifically, in response to a privilege assignment request event, the account processing unit 122 includes a privilege list (privilege list) in which an account of an event request source or an account to be assigned a privilege included in the account information is set in advance. Is present in the list of accounts that may be assigned).
When the account of the event request source included in the account information or the account to which privileges are assigned does not exist in the preset privilege list, the account processing unit 122 sets the password for the account (administrator / privilege assignment). Is notified to the authentication server 202 (step S43). Here, the administrator / privilege assignment account is all administrator authority accounts and privilege assignment accounts. Upon receipt of the administrator / privilege assigned account password change notification, the authentication server 202 validates the administrator / privilege assigned account password change notification (step S44).
After the account processing unit 122 changes the password, the login processing unit 132 performs forced logout for the account logged in to the communication device 402 using the password before the change (step S45).
Thereafter, when the insider logs in to the communication device 402 using the target account that is the target of the changed password, forced logout is performed (step S46). Similarly, when the insider logs in to the monitoring server 102 using the target account that is the target of the changed password, forced logout is performed (step S47).
Thereafter, when the user terminal logs in the administrator (step S48), the authentication server 202 notifies the user terminal of the password change (step S49).
When the user terminal logs in to the monitoring server 102 with a privilege assignment account (step S50), the monitoring server 102 notifies the user terminal of a password change (step S51). When the user terminal logs in to the account for privilege assignment to the communication device 402 (step S52), the communication device 402 notifies the user terminal of a password change (step S53).

  FIG. 9 is a sequence diagram for explaining a third example of the security countermeasure method in the communication system shown in FIG.

Here, it is assumed that an attacker (communication terminal operated by the attacker) makes a login request to the communication device 402 and the authentication server 202 using the administrator account information obtained illegally. The log of this process is stored in the log DB 212 of the authentication server 202.
The log acquisition unit 112 of the monitoring server 102 acquires an authentication log from the log DB 212 (step S61). Acquisition of this authentication log is performed periodically. Subsequently, the account processing unit 122 analyzes the authentication log acquired by the log acquisition unit 112 (step S62). Specifically, if the account authority is an administrator for an administrator account authentication request event, the account processing unit 122 manages the event request source IP address included in the account information in advance. It is determined whether it exists in the user terminal IP address list.
If the IP address of the event request source included in the account information does not exist in the preset administrator terminal IP address list, the account processing unit 122 changes the password of the account (administrator) and Is notified to the authentication server 202 (step S63). Upon receipt of the administrator account password change notification, the authentication server 202 validates the administrator account password change notification (step S64).
After the account processing unit 122 changes the password, the login processing unit 132 performs a forced logout for the account logged in to the communication device 402 using the password before the change (step S65).
Thereafter, when the attacker logs in to the communication device 402 using the administrator account that is the target of the changed password, forced logout is performed (step S66). Similarly, when an attacker logs in to the monitoring server 102 using the administrator account that is the target of the changed password, forced logout is performed (step S67).
Thereafter, when the user terminal logs in the administrator account to the monitoring server 102 (step S68), the monitoring server 102 notifies the user terminal of a password change (step S69). Further, when the user terminal logs in the administrator account to the communication device 402 (step S70), the communication device 402 notifies the user terminal of a password change (step S71).

As described above, when the account included in the acquired authentication log does not exist in the preset list, the monitoring server 102 changes the password used when logging in using the account, and changes the password before the change. Perform a forced logout for an account that is logged in using a password. Therefore, immediate countermeasures can be taken against unauthorized access.
(Fourth embodiment)

FIG. 10 is a diagram showing a fourth embodiment of the monitoring server of the present invention.
As shown in FIG. 10, the monitoring server 103 in this embodiment includes a log acquisition unit 113, an account processing unit 123, and a login processing unit 133. Note that the connection form between the monitoring server 103 and other devices or networks is the same as the connection form of the monitoring server 102 shown in FIG. FIG. 10 shows an example of main components related to the present embodiment among the components included in the monitoring server 103 of the present invention.

The log acquisition unit 113 acquires an authentication log from the authentication server 202 connected to the monitoring server 103.
In the authentication log acquired by the log acquisition unit 113, the account processing unit 123 determines whether the number of login requests made from a device to which the same IP address is assigned exceeds a predetermined threshold. Determine if.
When the account processing unit 123 determines that the number of times that the login request has been made in a predetermined period from devices to which the same IP address is assigned exceeds the threshold, the login processing unit 133 is assigned the IP address. Deny login request from the device.

  The security countermeasure method in the monitoring server 103 shown in FIG. 10 will be described below. FIG. 11 is a sequence diagram for explaining an example of a security countermeasure method in the monitoring server 103 shown in FIG.

Here, it is assumed that the attacker (the communication terminal operated by the attacker) is performing a brute force password, making an authentication request, and attacking the account list. The log of this process is stored in the log DB 212 of the authentication server 202.
The log acquisition unit 113 of the monitoring server 103 acquires an authentication log from the log DB 212 (step S81). Acquisition of this authentication log is performed periodically. Subsequently, the account processing unit 123 analyzes the authentication log acquired by the log acquisition unit 113 (step S82). In the authentication log acquired by the log acquisition unit 113, the account processing unit 123 determines whether the number of login requests made from a device to which the same IP address is assigned exceeds a predetermined threshold. It is determined whether or not (step S83). For example, the account processing unit 123 statistics the number of events for each authentication request destination and calculates the average value. If the number of events for one day is 10 times or more the normal average, the account processing unit 123 may consider that the number of login requests is abnormally large and determine that the threshold has been exceeded.
If the account processing unit 123 determines that the number of login requests made from a device to which the same IP address is assigned exceeds a threshold, the login processing unit 133 is assigned the IP address. Processing for rejecting the login request from the device (hereinafter referred to as a specific PC) is performed on the communication device 402 (step S84). Then, the communication device 402 performs a login rejection process from the specific PC (step S85). In addition, the login processing unit 133 of the monitoring server 103 also performs login rejection processing from the specific PC (step S86).
Thereafter, when the client logs in to the monitoring server 103 from the specific PC (step S87), the login processing unit 133 of the monitoring server 103 rejects the login (step S88). When the client logs in to the communication device 402 from the specific PC (step S89), the communication device 402 rejects the login (step S90).

  Thus, based on the authentication log, the monitoring server 103 rejects a login request from a specific PC when a specific PC to which the same IP address is assigned exceeds a threshold during a predetermined period. To do. Therefore, immediate countermeasures can be taken against unauthorized access.

  As described above, each function (process) is assigned to each component, but this assignment is not limited to the above. In addition, the configuration described above is merely an example, and the present invention is not limited to this.

  The processing performed by each component provided in each of the monitoring servers 100 to 103 described above may be performed by a logic circuit that is produced according to the purpose. Further, a computer program (hereinafter referred to as a program) in which processing contents are described as a procedure is recorded on a recording medium readable by each of the monitoring servers 100 to 103, and the program recorded on the recording medium is recorded on the monitoring servers 100 to 103. They may be read and executed by each. Recording media that can be read by each of the monitoring servers 100 to 103 include a floppy (registered trademark) disk, a magneto-optical disk, a DVD (Digital Versatile Disc), a CD (Compact Disc), and a Blu-ray (registered trademark) Disc. In addition to a transferable recording medium, it refers to a ROM (Read Only Memory), a RAM (Random Access Memory), a HDD (Hard Disc Drive), or the like built in each of the monitoring servers 100 to 103. The program recorded on this recording medium is read by a CPU (Central Processing Unit) provided in each of the monitoring servers 100 to 103, and the same processing as described above is performed under the control of the CPU. Here, the CPU operates as a computer that executes a program read from a recording medium on which the program is recorded.

A part or all of the above embodiment can be described as in the following supplementary notes, but is not limited thereto.
(Appendix 1) A log acquisition unit that acquires an authentication log from the authentication server;
If the account information included in the authentication log acquired by the log acquisition unit is different from that set in advance, the account processing unit for changing the password used for authentication and notifying the change of the password to the authentication server;
A monitoring server comprising: a login processing unit that, when the account processing unit changes the password, forcibly logs out an account that is logged in using the password before the change.
(Additional remark 2) The said account process part changes the said password, when the IP (Internet Protocol) address of event request origin contained in the said account information is not included in the preset account information, Additional remark 1 Monitoring server described in.
(Additional remark 3) The account processing part changes the password when the account of the request source of the request event for privilege assignment included in the account information is not included in the preset account information. Monitoring server described in.
(Additional remark 4) The said account process part changes the said password, when the IP address of the request origin of the update of account information included in the said account information is not included in the preset account information, Additional remark 2 Monitoring server described in.
(Additional remark 5) The said account process part changes the said password, when the IP address of the request origin of the authentication request contained in the said account information is not included in the preset account information, The additional password 2 is described. Monitoring server.
(Appendix 6) A log acquisition unit that acquires an authentication log from the authentication server;
An account processing unit that determines whether or not the number of times that a login request has been made in a predetermined period from devices to which the same IP address is assigned in the authentication log acquired by the log acquisition unit exceeds a threshold;
A monitoring server having a login processing unit that rejects a login request from a device to which the IP address is assigned when the account processing unit determines that the number of times exceeds the threshold.
(Supplementary Note 7) Processing for obtaining an authentication log from the authentication server;
When the account information included in the acquired authentication log is different from that set in advance, a process of changing a password used for authentication;
A process of notifying the authentication server of the password change;
A security countermeasure method for executing a forced logout for an account logged in using the password before the change when the password is changed.
(Supplementary Note 8) Processing for obtaining an authentication log from an authentication server;
In the acquired authentication log, a process of determining whether or not the number of times that a login request is made in a predetermined period from devices to which the same IP address is assigned exceeds a threshold value;
A security countermeasure method for performing a process of rejecting a login request from a device to which the IP address is assigned when the number of times exceeds the threshold.
(Appendix 9)
The procedure to acquire the authentication log from the authentication server,
If the account information included in the acquired authentication log is different from that set in advance, a procedure for changing the password used for authentication;
A procedure for notifying the authentication server of the change of the password;
A program for executing a forced logout procedure for an account logged in using the password before the change when the password is changed.
(Appendix 10)
The procedure to acquire the authentication log from the authentication server,
In the acquired authentication log, a procedure for determining whether or not the number of log-in requests made in a predetermined period from devices to which the same IP address is assigned exceeds a threshold;
A program for executing a procedure for rejecting a login request from a device to which the IP address is assigned when the number of times exceeds the threshold.

100 to 103 Monitoring server 110 to 113 Log acquisition unit 120 to 123 Account processing unit 130 to 133,232 Login processing unit 142 RADIUS Client processing unit 202 Authentication server 212 Log DB
222 Account Management Unit 242 RADIUS Server Processing Unit 302-1 to 302-3 User Terminal 402 Communication Device 502 Communication Network

Claims (10)

A log acquisition unit for acquiring an authentication log from the authentication server;
If the account information included in the authentication log acquired by the log acquisition unit is different from that set in advance, the account processing unit for changing the password used for authentication and notifying the change of the password to the authentication server;
A monitoring server comprising: a login processing unit that, when the account processing unit changes the password, forcibly logs out an account that is logged in using the password before the change. The monitoring server according to claim 1,
The account processing unit is a monitoring server that changes the password when an IP (Internet Protocol) address of an event request source included in the account information is not included in preset account information. The monitoring server according to claim 1,
The account processing unit is a monitoring server that changes the password when a request source account of a privilege assignment request event included in the account information is not included in preset account information. The monitoring server according to claim 2,
The account processing unit is a monitoring server that changes the password when the IP address of the account information update request source included in the account information is not included in the preset account information. The monitoring server according to claim 2,
The account processing unit is a monitoring server that changes the password when an IP address of an authentication request source included in the account information is not included in preset account information. A log acquisition unit for acquiring an authentication log from the authentication server;
An account processing unit that determines whether or not the number of times that a login request has been made in a predetermined period from devices to which the same IP address is assigned in the authentication log acquired by the log acquisition unit exceeds a threshold;
A monitoring server having a login processing unit that rejects a login request from a device to which the IP address is assigned when the account processing unit determines that the number of times exceeds the threshold. Processing to obtain the authentication log from the authentication server;
When the account information included in the acquired authentication log is different from that set in advance, a process of changing a password used for authentication;
A process of notifying the authentication server of the password change;
A security countermeasure method for executing a forced logout for an account logged in using the password before the change when the password is changed. Processing to obtain the authentication log from the authentication server;
In the acquired authentication log, a process of determining whether or not the number of times that a login request is made in a predetermined period from devices to which the same IP address is assigned exceeds a threshold value;
A security countermeasure method for performing a process of rejecting a login request from a device to which the IP address is assigned when the number of times exceeds the threshold. On the computer,
The procedure to acquire the authentication log from the authentication server,
If the account information included in the acquired authentication log is different from that set in advance, a procedure for changing the password used for authentication;
A procedure for notifying the authentication server of the change of the password;
A program for executing a forced logout procedure for an account logged in using the password before the change when the password is changed. On the computer,
The procedure to acquire the authentication log from the authentication server,
In the acquired authentication log, a procedure for determining whether or not the number of log-in requests made in a predetermined period from devices to which the same IP address is assigned exceeds a threshold;
A program for executing a procedure for rejecting a login request from a device to which the IP address is assigned when the number of times exceeds the threshold.

Images