JP2002366453A - External connection monitoring and notifying system and its method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a network system for preventing the leakage of information due to external connection by a client. SOLUTION: A terminal 4 monitors dial-up connection and disconnection to an Internet 901 by the terminal itself, and at the time of detecting the dial-up connection, the terminal 4 transfers a message indicating that external connection is finished through an LAN 900 to preliminarily set designation, and at the time of detecting the dial-up disconnection, the terminal 4 transfers the external connection information including the connection destination of the dial-up connection to a management server 1. At the time of receiving the connection information, the management server 1 confirms the contents, and transfers the message indicating that the external connection is finished to the preliminarily set destination.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

The present invention relates to an external connection monitoring / reporting system and method, and more particularly to an external connection monitoring / reporting system and method when a terminal connected to a LAN makes an external connection without going through the LAN.

[0002]

2. Description of the Related Art At present, some measures have been taken with respect to network security in a network system in which a private LAN is constructed, by improving recognition of unauthorized access from outside such as introduction of a firewall. However, almost no information leakage measures are taken from inside to outside. Conventional information leakage involves copying the paper / copying it to an external recording medium such as a floppy (registered trademark) or MO / connecting a personal computer, etc., and it is difficult to find out, There was an event.

[0003]

However, with the recent rapid spread of mobile phones and the Internet, mobile phones are connected to terminals to access providers of personal contracts. From there, information extracted in the form of an e-mail attachment can be transmitted to the outside. In such a case, there is a problem that information leakage cannot be prevented because no trace such as remains in the call record remains since the call does not pass through the exchange.

[0004] It is an object of the present invention to provide a network system which solves the above problems and prevents information leakage due to external connection of a client.

[0005]

In order to achieve the above object, a first external connection monitoring and reporting system according to the present invention comprises:
An external connection monitoring / reporting system including a plurality of terminals connected to an AN, wherein the terminal itself monitors a dial-up connection that does not pass through the LAN, and the terminal detects the dial-up connection by the monitoring unit. Transfer means for transferring the external connection information to a destination set in advance via the Internet.

A second external connection monitoring / reporting system according to the present invention is an external connection monitoring / reporting system including a plurality of terminals connected to a LAN and a management server, wherein the terminal itself is connected via the LAN. Monitoring means for monitoring no dial-up connection and disconnection, and transferring a message indicating that an external connection has been made to the terminal managed by an administrator via the LAN when the monitoring means detects a dial-up connection. Transfer means, and when the monitoring means detects disconnection after dial-up connection,
And second transfer means for transferring external connection information including a connection destination through a dial-up connection to the management server via the management server.

A third external connection monitoring and notification system according to the present invention is an external connection monitoring and notification system including a plurality of terminals connected to a LAN and a management server. Monitoring means for monitoring dial-up connection and disconnection not via the LAN, and transferring a message indicating that an external connection has been made to a preset destination via the LAN when the monitoring means detects a dial-up connection. And a second transfer unit for transferring external connection information including a connection destination by a dial-up connection to the management server when the monitoring unit detects disconnection after the dial-up connection, wherein the management server The first storage means for storing the received external connection information when the external connection information is received, and Checking means for checking whether the monitoring means of the terminal is operating normally, second storing means for storing as alive information if the checking means is not operating normally, and first storing means And a third transfer unit for transmitting a message indicating that an external connection has been made based on the presence or absence of the external connection from the external connection information accumulated in step (1).

[0008] A first external connection monitoring and reporting method according to the present invention is an external connection monitoring and reporting method in which a plurality of terminals connected to a LAN are prepared.
A dial-up connection that does not intervene is monitored, and when a dial-up connection is detected, external connection information is transferred to a preset destination via the LAN.

A second external connection monitoring and reporting method according to the present invention is an external connection monitoring and reporting method in which a plurality of terminals connected to a LAN are prepared, wherein the terminal itself does not have a dial-up connection via the LAN. Monitor the disconnection, and if the terminal detects a dial-up connection,
A message indicating that an external connection has been made to the terminal managed by the administrator via the LAN. If the terminal detects disconnection after the dial-up connection, the terminal is connected to the management server via the LAN by a dial-up connection. It is characterized in that external connection information including a connection destination is transferred.

A third external connection monitoring and notification method according to the present invention is an external connection monitoring and notification method in which a plurality of terminals connected to a LAN and a management server are prepared.
The terminal itself monitors the dial-up connection and disconnection without passing through the LAN, and when detecting the dial-up connection, transfers a message indicating that an external connection has been made to a preset destination via the LAN, and after the dial-up connection, When the disconnection is detected, the external connection information including the connection destination by the dial-up connection is transferred to the management server. When the management server receives the external connection information, the management server accumulates and manages the received external connection information, and stores the accumulated external connection information. It is characterized by transmitting a message indicating that an external connection has been made based on the presence or absence of an external connection from the managed external connection information.

Further, in the third external connection monitoring / reporting method, the management server monitors the terminal for a dial-up connection monitoring operation of the terminal at regular intervals, and internally stores the monitoring result. It is characterized by storing and managing.

A fourth external connection monitoring and reporting method according to the present invention is an external connection monitoring and reporting method in which a plurality of terminals connected to a LAN and a management server are prepared, wherein the terminal and the processor of the management server are provided. Prepare a program of the external connection monitoring system to be executed by, the external connection monitoring system program monitors the external connection of the terminal itself by the processor of the terminal, the terminal managed by the administrator when the external connection is detected A first program for notifying that an external connection has been detected, a second program for alive monitoring of the first program by the processor of the terminal, and an external connection from the terminal by the processor of the management server. A third program for storing and managing connection information and storing and managing abnormal information due to abnormalities in cooperation with the second program. Includes a ram, and a fourth program for notification and display to the terminal of the manager based on the information the storage managed by the processor of the management server,
The processor of the terminal starts executing the first and second programs at the time of device startup, the processor of the management server starts executing the third and fourth programs at the time of device startup, The processor of the terminal that executes the first and second programs monitors the execution of each of the first and second programs themselves, restarts the own program if there is an abnormality, and executes the third program. The processor of the management server that executes the fourth program monitors the execution of the third and fourth programs themselves, and restarts the own program if there is an abnormality. .

Further, in the fourth external connection monitoring / reporting method, when the processor of the terminal executing the first program detects disconnection after external connection, the external processor including connected destination information includes the destination information. It is characterized in that connection information is transmitted to the management server.

Further, in the fourth external connection monitoring / reporting method, the processor of the management server executing the third program is configured to execute the third program by the processor of the terminal when cooperating with the second program. It is characterized in that whether or not the second program is being executed is monitored, and if abnormal, accumulation and management of the abnormality information indicating an abnormality of the terminal is performed.

[0015]

Next, a first embodiment of the present invention will be described with reference to the drawings. Referring to FIG.
FIG. 1 is a system block diagram showing a configuration example of a system according to a first embodiment of the present invention. In this system, a management server 1 and mailboxes of each user used by a LAN 900 including an administrator are registered. Mail server 2 and a terminal 3 which is a client for the administrator,
It is composed of a plurality of terminals 4 as clients for general users, a LAN 900 as a local area network, and the Internet 901 connected from the terminals 4. The management server 1, the mail server 2, and the terminals 3 and 4 are connected to the LAN 900. When the user of the terminal 4 connects the terminal 4 to the Internet or the like without using the LAN 900, for example, the user connects to the provider via a telephone line using a modem (not shown) built in the terminal 4. Each WEB server on the Internet 901 which is an external connection (in this case, a W
(Including an EB server) or a mobile terminal via a provider. For convenience of description of the present invention, two terminals 4 for general users are used.
It is assumed that any number of general user terminals may be connected to 0.

The management server 1, the mail server 2, the terminal 3,
Reference numeral 4 denotes an information processing device (for example, a workstation on the server side and a personal computer on the terminal side) operated by a processor (not shown) under program control.

The external connection monitoring and notification system operating on the management server 1 and the terminal 4 is constituted by the following application software (programs). That is, a dial-up monitor program for monitoring the external connection on the terminal 4, a server agent program for alive monitoring of the dial-up monitor program on the terminal 4, and a storage management of the external connection result and a server agent program on the management server 1. It consists of a server manager program for coordination and a server analyzer program for notifying and displaying information to the administrator based on the information accumulated and managed. Each of the above programs is further divided into a service (control) and an application. Performs alive monitoring of the application, and if the application has been terminated, restarts the service.

Referring to FIG. 3, there is shown a functional block diagram in a case where a program of the above-described external connection monitoring system is installed and each processor executes the program. That is, the terminal 4 has a server agent external connection monitoring unit 41 for executing a server agent program and a dial-up external connection monitoring unit 42 for executing a dial-up monitor program. The management server 1 includes a server manager external connection monitoring unit 11 for executing a server manager program, a server analyzer external connection monitoring unit 12 for executing a server analyzer program, and an external connection result folder 1.
5, an alive monitoring result folder 16, a primary storage folder 13, and a storage folder 14.

The dial-up monitor external connection monitoring unit 42 of the terminal 4 shown in FIG. 3 comprises a dial-up monitor unit 421 for monitoring the dial-up connection of the terminal 4 itself, and a client service unit 422 for alive monitoring of the dial-up monitor unit 421. The server agent external connection monitoring unit 41 includes an agent application unit 411 that monitors the aliveness of the client service unit 422 and an agent service unit 412 that monitors the aliveness of the agent application unit 411.

The server manager external connection monitoring unit 11 of the management server 1 shown in FIG. 3 comprises a manager application unit 111 and a server service 112 for monitoring the aliveness of the manager application unit 111. The server analyzer external connection monitoring unit 12 An analyzer application 1 unit 121 that analyzes each storage information in the storage folder 14 and notifies the administrator as necessary, and an analyzer application 2 unit 122 that displays each storage information on a screen of the management server 1 (not shown).
And an analyzer service unit 123 that performs alive monitoring of the analyzer application 1 unit 121. In addition,
The manager application unit 111 performs alive monitoring of the agent application unit 411 of the terminal 4, and stores a result of the alive monitoring in the alive monitoring result folder 16 if abnormal.
The external connection information received from the external connection result folder 15
And the information stored in the alive monitoring result folder 16 and the external connection result folder 15 at regular time intervals (in this case, external connection and alive monitoring)
It has a function of storing the information once in the primary storage folder 13 and transferring the stored information to the storage folder 14 classified by month.

External connection result folder 15 of management server 1
The alive monitoring result folder 16, the primary storage folder 13, and the storage folder 14 are allocated in a non-volatile storage unit (for example, a magnetic disk). The external connection result folder 15 includes a dial-up monitor 421 of each terminal 4.
Is temporarily stored, and the alive monitoring result folder 16 temporarily stores error information (alive and abnormal information) when the alive monitoring of the agent application unit 411 detected by the manager application unit 111 is performed. , The primary storage folder 13 includes the manager application unit 11
The external connection information in the external connection result folder 15 and the life and death monitoring information in the life and death monitoring result folder 16 are stored once every time according to 1. The information transferred from the primary storage folder 13 by 111 is classified every month and accumulated as a history. In the external connection monitoring result folder 15, the alive monitoring result folder 16, and the primary storage folder 13, information transferred to other folders is deleted from each folder.

The present invention provides a series of functions for monitoring the communication connection activity from each personal terminal 4 to the outside using a mobile phone or the like and notifying the operation manager. Regarding the first embodiment, an outline of the operation of each functional block will be described with reference to FIG. In this case, the monitoring is not displayed on the menu or the like so that the user of the terminal 4 cannot understand the monitoring action.

Referring to FIG. 3, client service unit 422, dial-up monitor unit 421, agent service unit 412, and agent application unit 411
Each of the terminals 4 is automatically started as a resident program when the terminal 4 is started (device startup). The server service unit 112, the manager application unit 11
1. The analyzer service unit 123 and the analyzer application 1 unit 121 are automatically started when the management server 1 is started (device startup) as resident programs of the management server 1.

In the terminal 4, the client service unit 42
2 is for the dial-up monitor 421, the agent service unit 412 is for the agent application unit 411, in the management server 1, the server service 112 is for the manager application unit 111, and the analyzer service 123 is for the analyzer application 1 unit 121. On the other hand, alive monitoring is performed at predetermined intervals (for example, by a timer interrupt not shown), and if the program is terminated by the user,
It has a function to restart. In this case, each service unit performs alive monitoring by reading at a predetermined interval a process list in a memory (not shown), which is OS information, as to whether each application unit is executing or not. If the program to be executed is not set during execution, it is determined that the program has been terminated, and the terminated program of the application section (monitor section) is forcibly re-executed.

The dial-up monitor 421 of the terminal 4
Monitors the external connection action of the terminal 4 itself, collects information when a connection such as dial-up is performed, and immediately notifies the terminal 3 of the administrator. Further, when the dial-up monitor unit 421 confirms that the line has been disconnected,
The collected information is transferred to the management server 1 so as to be stored in the external connection result folder 15 of the management server 1. In this case, the dial-up monitor unit 421 determines whether a dial-up connection is established by reading out active dial-up entry information on a memory managed by the network OS.

The agent application unit 411 monitors the state of the client service unit 422 at a predetermined interval, and restarts the client service unit 422 if it has been terminated. Also in this case, the agent application unit 411 performs alive monitoring by reading out a process list on the memory, which is OS information, at a predetermined constant interval to determine whether the client service unit 422 is being executed, and determines whether the client service unit 422 is running. If the program is not set during execution, it is determined that the program is terminated, and the program of the client service unit 422 is forcibly re-executed.

On the other hand, the manager application unit 111 of the management server 1 collects information stored in the external connection result folder 15 and the alive monitoring result folder 16 at regular intervals for each folder, and collects the information in the primary storage folder 1.
3 and temporarily read the information stored in the primary storage folder 13 and transfer it to the storage folder 14. In addition, the manager application unit 111 performs alive monitoring of the agent application unit 411 at regular intervals to determine whether or not the service program on the terminal 4 is stopped, and stores the result in the alive monitoring result folder 16 when an abnormality is detected.

The stored information stored in the storage folder 14 of the management server 1 is read by the analyzer application 1 unit 121, and only the information that the external connection has been made among the newly detected information is notified to the administrator terminal 3. Is done. The agent application unit 4 by the manager application unit 111
The alive monitoring of 11 is performed only when the terminal 4 is logically connected to the LAN 900 (for example, when the terminal 4 is logged on to the management server 1 that manages the NetWare network and a communication path is established). The manager application unit 111 performs monitoring by exchanging messages with the terminal 4 at intervals. That is, the manager application unit 111
Performs alive monitoring based on the presence or absence of a monitoring response message that is a reply from the agent application unit 411 to the monitoring confirmation message transmitted by the manager application unit 111, and the operation state of the dial-up monitor external connection monitoring unit 42.

The analyzer application 1 unit 121 refers to the storage information stored in the storage folder 14 and, when the external connection information is recognized from the new information, the defined destination (the storage unit (not shown) The e-mail address is set beforehand).

The analyzer application 2 unit 122 is manually started by an administrator from an external input unit (for example, a keyboard) (not shown) of the management server 1, and the storage folder 1
The connection result, alive monitoring result, and the like are displayed on the screen based on the accumulated information accumulated in 4. Further, the administrator outputs the content specified from the external input unit in a CSV format (outputs to a file (not shown)).

Next, the operation of the first embodiment of the present invention will be described with reference to FIGS. Now, the management server 1 and the terminal 4 (the client 1 and the client 2 in FIG. 1) are loaded with the program of the external connection monitoring system, and the programs of the respective external connection monitoring systems are operating. Assume that the user of the terminal 4 of the client 2 (hereinafter simply referred to as the terminal 4) connects to the Internet 901 from the terminal 4 by a dial-up IP connection (or simply referred to as a dial-up connection) in order to connect to the Internet.

Then, in the terminal 4, the dial-up monitor 421 monitoring whether there is active dial-up information detects the dial-up connection, and stores the information that the dial-up connection is being performed in a storage unit (not shown). A notification is sent to a preset e-mail address of the administrator. That is, the terminal 4 sends the “client 2” to the administrator terminal 3 via the mail server 2.
Is connected to the Internet through an external connection. "
Sequence S1, S2).

Thereafter, the dial-up monitor section 421
Collects the Internet connection destination information (telephone number) and the like at the time of dial-up connection when the terminal 4 confirms the disconnection of the line with the Internet 901, and uses the collected information as the external connection result information as the management server 1 (Step S3).

The management server 1 that has received the collection information passes control to the manager application unit 111 of the server manager external connection monitoring unit 11. Then, the manager application unit 11
1 stores the received collection information in the external connection result folder 15. The manager application unit 111 sequentially checks whether information is stored in the external connection result folder 15 and the alive monitoring result folder 16 at regular intervals, but first the information is stored in the external connection result folder 15. In this case (in this case, the information is stored in the external connection result folder 15), a plurality of pieces of information stored in the external connection result folder 15 are put together and temporarily stored in the primary storage folder. If information is also stored in the life and death monitoring result folder 16, the manager application unit 111 collectively stores a plurality of pieces of information stored in the life and death monitoring result folder 16 and temporarily stores the information in the primary storage folder 13. Furthermore,
The manager application unit 111 transfers the information stored in the primary storage folder 13 to a corresponding area classified by month in the storage folder 14. When the information is stored in the storage folder 14, the analyzer application 1 unit 121 that searches the storage folder 14 at regular intervals,
By referring to the newly stored information out of the information stored in the database, it is determined that the information is related to external connection.If it is detected that external connection has been made, it is determined as unauthorized access by dial-up connection. The terminal 4 is stored in the destination of the administrator set in a storage unit (not shown) in advance.
(Client 2) transfers a mail indicating that it has been externally connected (sequence S4). In this case, the notified information includes connection destination information (telephone number) and the like. Therefore, the administrator can know which terminal 4 and which external connection was made.

When the administrator executes the analyzer application 2 unit 122 from the input unit of the management server 1, the analyzer application 2 unit 122 displays a menu screen for displaying and analyzing the status of the management result on the screen, and performs menu selection and Editing is performed based on the accumulation information of the accumulation folder 14, and the result is displayed on the screen (sequence S5).

Next, a second embodiment of the present invention will be described with reference to the drawings. Referring to FIG. 4, there is shown a system block diagram in which FIG. 1 showing the first embodiment of the present invention is arranged for each department, and is transferred to a higher-level management machine (a management server of a general department). It is composed of a plurality of departments 200 and a department 100 which is a supervising department. In the system block diagram, as one of the departments 200, the department B
And the department A as the department 100, respectively.

The departments 100 and 200 are the management servers 6 and 7
Since the configuration is the same as that of the first embodiment except for the above, the description is omitted. That is, the management server 7 is provided in the department 100 instead of the management server 1 shown in the first embodiment.
At 00, a management server 6 is connected in place of the management server 1. Note that the department 100 and each department 2 are connected to the LAN 900.
00 is connected.

The management servers 6 and 7 are information processing apparatuses (for example, workstations) operated by a processor (not shown) under program control.

Referring to FIG. 5, the management server 6 performs the same operation in the department 200 as the management server 1 shown in the first embodiment, and the management server 7
The same operation as that of the management server 1 described in the first embodiment is performed.

The management server 6 is different in that a server analyzer external connection monitoring unit 62 is used instead of the server analyzer external connection monitoring unit 12 shown in the first embodiment.

Server analyzer external connection monitoring unit 62
Is the analyzer application unit 12 shown in the first embodiment.
The difference is that an analyzer application unit 621 is used instead of 1. That is, the analyzer application unit 621
When referring to the stored information in the storage folder 14 with respect to the function of the analyzer application unit 121, if the newly detected information is recognized as information relating to the external connection, the management server 7 transmits the information to the management server 7 via the LAN 900. The difference is that a function of transferring newly detected collection information in the storage folder 14 is added. The other functions in the management server 6 are the same and will not be described.

The management server 7 uses a server manager external connection monitoring unit 71 instead of the server manager external connection monitoring unit 11 shown in the first embodiment, and adds an upper transfer folder 77. Different.

Server analyzer external connection monitoring unit 71
Is the manager application unit 111 shown in the first embodiment.
In that a manager application unit 711 is used instead of. That is, the manager application unit 711 performs the function of the manager application unit 111 on the management server 7.
Has a function of taking over the control when the notification information is received from the management server 6 and storing the received notification information in the upper transfer folder 77;
And collects the information, and stores the primary storage folder 13
This is different from the first embodiment in that a function of temporarily storing the information is added. The other functions in the server 7 are the same, and the description is omitted. The upper transfer folder 77 is also allocated in a non-volatile storage unit (for example, a magnetic disk) together with other folders.

Next, the operation of the second embodiment of the present invention will be described with reference to FIGS. Now, the management server 7a, the management server 6b, the terminal 4a, the terminal 4b (4
b-1: client 1, 4b-2: client 2)
Has an external connection monitoring system program, and each external connection monitoring system program
In the operating state, it is assumed that the user of the terminal 4b-2 connects to the Internet 901 by a dial-up IP connection in order to connect to the Internet.

Then, in the terminal 4b-2, the dial-up monitor unit 421 monitoring whether there is an active dial-up entry detects the dial-up connection, and stores information indicating that the dial-up connection is being performed. Notify to the e-mail address set in the section. In this case, the e-mail addresses set in the storage unit are the e-mail address of the administrator who manages the system (the e-mail address under the jurisdiction of the mail server 2a in the unit 100) and the e-mail address of the administrator of the unit B (the unit 200) (the mail address under the jurisdiction of the mail server 2b). That is, the terminal 4b-2 is connected to the LAN
900, to the administrator terminal 3a via the mail server 2a,
Administrator terminal 3 via LAN 900 and mail server 2b
b, an e-mail with information that "the client 2 is connected to the Internet through an external connection" is transmitted (sequences S01 and S02 in FIG. 1).
In this case, the mail address of the manager is not stored in the storage unit, but is a single mail address, and is transmitted to the plurality of managers by setting in the mail server 2.

Thereafter, the terminal 4b-2 is connected to the Internet 9
Upon confirming the disconnection of the line from No. 01, Internet connection destination information (telephone number) and the like are collected, and the collected collection information is transmitted to the management server 6b as external connection result information (sequence S03).

The management server 6b having received the collection information passes control to the manager application unit 111 of the server manager external connection monitoring unit 11. Then, manager application part 1
11 stores the received collection information in the external connection result folder 15
To store. Further, the manager application unit 111 checks whether collection information is stored in the external connection result folder 15 and the alive monitoring result folder 16 at regular intervals,
Since the collection information is stored (in this case, stored in the external connection result folder 15), if the information is stored in the external connection result folder 15, the information is collectively stored once in the primary storage folder 13. In this case, if the alive monitoring result folder 16 also includes a plurality of pieces of information, the manager
3 once. Further, the manager application unit 111
Reads the collection information from the primary storage folder 13 and transfers the collection information to a corresponding area among the areas classified by month in the storage folder 14. In this case, the manager application unit 111 clears the external connection result folder 15, the alive monitoring result folder 16, and the primary storage folder 13. When the collection information is stored in the storage folder 14, the analyzer application 1 unit 621 refers to the storage information stored in the storage folder 14 and stores the L in the management server 7a of the department A.
The newly detected collection information in the storage folder 14 is transferred to the management server 7a as notification information via the AN 900 (sequence S04).

Further, the analyzer application 1 unit 621
Based on the new collection information stored in the storage folder 14, a message indicating that an external connection has been made is transmitted to the destination of the administrator in the department B set in a storage unit (not shown) in advance (sequence S05). ). In this case, the notified information includes connection destination information (telephone number) and the like.

On the other hand, the management server 7a receiving the notification information from the management server 6b controls the manager application unit 71
Pass to 1. Then, the manager application unit 711 stores the received notification information in the upper transfer folder 77. After that, the manager application unit 711 checks the external connection result folder 15, the alive monitoring result folder 16, and the upper transfer folder 77 at regular intervals to check the upper transfer folder 7.
The information in 7 is read out, put together, and temporarily stored in the primary storage folder 14. In this case, there is no information in the external connection result folder 15 and the alive monitoring result folder 16 other than the upper transfer folder 77, so that nothing is performed. Further, the manager application unit 711 transfers the information stored in the primary storage folder 13 to the storage folder 14. In this case, information is classified and stored in the storage folder 14 every month. Next, the analyzer application unit 121 detects notification information from the department B when checking whether information is stored in the storage folder 14 at regular intervals, and sets the notification information in a storage unit (not shown) in advance. A message indicating that an external connection has been made is transmitted to the designated administrator (sequence S06). In this case, the information notified is
Connection destination information (telephone number) and the like are also included.

Next, the operation when the terminal 4a in the department A makes an unauthorized access will be described. Then, at the terminal 4a, the dial-up monitor unit 421 that monitors whether there is an active dial-up entry,
A dial-up connection is detected, and information indicating that the dial-up connection is being performed is notified to a mail address of an administrator preset in a storage unit (not shown). That is, the terminal 4a has transmitted an e-mail carrying information that "the client 4 is connected to the Internet through an external connection" to the administrator's terminal 3a via the mail server 2a (see FIG. 4). Sequence S11,
S12).

Thereafter, the terminal 4a is connected to the Internet 901
When it is confirmed that the line has been disconnected, Internet connection destination information (phone number) and the like are collected, and the collected collection information is transmitted to the management server 7a as external connection result information (sequence S13).

The management server 7a that has received the collection information passes control to the manager application unit 711 of the server manager external connection monitoring unit 71. Then, the manager application unit 7
11 stores the received notification information in the external connection result folder 15
After that, when the external connection result folder 15, the alive monitoring result folder 16, and the upper transfer folder 77 are confirmed at regular intervals, the information of the external connection result folder 15 is read out, and the information is collectively stored in the primary storage folder 14. Store once. In this case, there is no information in the alive monitoring result folder 16 and the upper transfer folder 77 other than the external connection result folder 15, so that nothing is performed. Further, the manager application unit 711 transfers the information stored in the primary storage folder 13 to the storage folder 14. In this case, information is classified and stored in the storage folder 14 every month. When the collection information is stored in the storage folder 14,
The analyzer application 1 unit 121 refers to the storage information stored in the storage folder 14 and recognizes that the newly stored information is an external connection. Is transmitted to the destination (step S14). In this case, the notified information includes connection destination information (telephone number) and the like.

Therefore, in the department A which is the supervising department,
Even in the case of unauthorized access in the subordinate department B, the administrator,
It is possible to know by e-mail whether the terminal 4a is externally connected on the terminal 3a. That is, distributed management for each department and collective management for the computer department can be performed.

As described above, the present invention monitors an external communication connection operation performed by a mobile phone or the like without using an infrastructure such as a LAN from each personal work terminal, and notifies the operation manager. Since the system is provided with a series of functions up to the report [flash report function to report (mail) at the time of detection, report function to report based on the result information after disconnection], the administrator must
Unauthorized access from the terminal 4 connected to N can be detected, and spoofing when a private terminal is connected can be detected.

Further, according to the present invention, the operation manager who receives the report can check the external connection result on the screen and output the data to a CSV file so that it can be analyzed from various angles using spreadsheet software or the like. Provides a function to perform overall management in the event of unauthorized access to the entire system.

Further, the present invention is configured such that the user of the terminal does not understand the monitoring action by taking measures that are not displayed on the menu and the like and is divided into a service program and an application program. Even if the presence of the application program is detected by the terminal user and stopped, the restart can be performed by monitoring from the service program.

In addition, the present invention introduces a T-LINK (task link) system in which the server manager program of the management server 1 monitors the operation of the server agent program in the terminal 4, so that the terminal-side server agent external When the agent service unit 411 of the connection monitoring unit 41 is stopped, the management server 1 can detect the agent service unit 411 and can detect an unauthorized access due to a program modification of the terminal 4.

[0058]

The first effect is that when an external connection is detected, a notification is sent to the administrator. The reason is that the terminal itself monitors the status of the dial-up connection, and reports information obtained at the time when the use is permitted if the terminal is connected to the network.

The second effect is that the state of external connection can be analyzed. The reason is that, even if external connection is performed in a state disconnected from the internal network, the external connection information is transferred to the management machine when it is confirmed that the external machine is connected to the internal network.

A third effect is that the monitoring operation on the terminal side is invisible to the operator. The reason for this is that no portion is displayed on a portion that is noticeable to the operator, such as the start menu / task bar / application information.

The fourth effect is that the connection of a personal terminal is also left as a history. The reason is that cooperation is performed between the management machine and the terminal. Furthermore, even if synchronization is achieved, if the monitoring program has been terminated,
This is because the information is accumulated.

[Brief description of the drawings]

FIG. 1 is a sequence diagram showing a series of flows when an external connection is performed by a terminal according to the first embodiment of the present invention.

FIG. 2 is a system block diagram illustrating a system configuration according to the first embodiment of this invention.

3 is a block diagram showing a configuration of functional blocks when a system program in a management server and a terminal in FIG. 2 operates.

FIG. 4 is a sequence diagram showing a system configuration according to the second embodiment of the present invention and a series of flows when an external connection is made by a terminal;

FIG. 5 is a block diagram showing a configuration of functional blocks when a system program in the management server and the terminal in FIG. 4 operates.

[Explanation of symbols]

 1, 6, 7 management server 2 mail server 3, 4 terminal 11, 71 server manager external connection monitoring unit 12, 62 server analyzer external connection monitoring unit 13 primary storage folder 14 storage folder 15 external connection result folder 16 alive monitoring result folder 77 Upper transfer folder 41 Server agent external connection monitoring unit 42 Dial-up monitor external connection monitoring unit 100, 200 Department 111, 711 Manager application unit 112 Server service unit 121, 621 Analyzer application 1 unit 122 Analyzer application 2 unit 123 Analyzer service unit 411 Agent application Unit 412 agent service unit 421 dial-up monitor unit 422 client service unit 900 LAN 901 Internet

 ──────────────────────────────────────────────────続 き Continuing on the front page (72) Inventor Shoji Kobayashi 5-7-1 Shiba, Minato-ku, Tokyo Within NEC Corporation (72) Inventor Ichiichi Yamauchi 4-760, Kinuyama, Matsuyama-shi, Ehime Prefecture Shikoku Japan Electric Software Co., Ltd. Inside Software Co., Ltd. (72) Inventor Takahiro Shimizu 4-760 Kinuyama, Matsuyama-shi, Ehime Prefecture Shikoku Nippon Electric Software Co., Ltd. (72) Miho Terao 4-760, Kinuyama, Matsuyama-shi, Ehime Prefecture Shikoku Nippon Electric Software Co. F term in the company (reference) 5B089 GA04 GB02 JA35 KB04 5K033 AA08 CB08 DA06 DB20 EA03 EA07 5K101 KK02 LL01 LL05 PP06 RR27

Claims (10)

[Claims] 1. An external connection monitoring and reporting system comprising a plurality of terminals connected to a LAN, wherein the terminal itself monitors a dial-up connection that does not pass through the LAN, and the monitoring unit performs a dial-up connection. Transfer means for transferring external connection information to a preset destination via the LAN when detected, the external connection monitoring and reporting system. 2. An external connection monitoring / reporting system comprising a plurality of terminals connected to a LAN and a management server, wherein the terminal itself monitors dial-up connection and disconnection not via the LAN, First transfer means for transferring a message indicating that an external connection has been made to the terminal managed by the administrator via the LAN when a dial-up connection is detected by the monitoring means, and disconnection after dial-up connection by the monitoring means When L is detected,
And a second transfer unit for transferring external connection information including a connection destination through a dial-up connection to the management server via an AN. 3. An external connection monitoring / reporting system comprising a plurality of terminals connected to a LAN and a management server, wherein the terminal monitors dial-up connection and disconnection of the terminal itself without passing through the LAN. Means for detecting a dial-up connection by the monitoring means.
A first transfer unit for transferring a message indicating that an external connection has been made to a preset destination via N; and an external unit including a connection destination by the dial-up connection when the monitoring unit detects disconnection after the dial-up connection. A second transfer unit configured to transfer connection information to the management server, wherein the management server receives the external connection information, stores the received external connection information, Checking means for checking whether or not the monitoring means of the terminal is operating normally with respect to the terminal, second storage means for storing as alive information if the checking means does not operate normally, A third transfer unit that transmits a message indicating that an external connection has been made based on the presence or absence of an external connection from the external connection information stored by the first storage unit. External connection monitoring and reporting system to be. 4. An external connection monitoring and reporting method in which a plurality of terminals connected to a LAN are prepared, wherein the terminal itself monitors a dial-up connection that does not pass through the LAN, and detects a dial-up connection. And transmitting the external connection information to a preset destination. 5. An external connection monitoring and reporting method in which a plurality of terminals connected to a LAN are prepared, wherein the terminal itself monitors dial-up connection and disconnection not via the LAN, and the terminal detects a dial-up connection. Transfer a message indicating that an external connection has been made to the terminal managed by the administrator via the LAN, and when the terminal detects disconnection after dial-up connection,
And transmitting external connection information including a connection destination through a dial-up connection to the management server via the management server. 6. An external connection monitoring and reporting method in which a plurality of terminals connected to a LAN and a management server are prepared, wherein the terminal monitors dial-up connection and disconnection of the terminal itself without passing through the LAN, When a dial-up connection is detected, a message indicating that an external connection has been made to a preset destination via the LAN is transferred, and when disconnection after the dial-up connection is detected, external connection information including a connection destination by the dial-up connection Is transferred to the management server, and when the management server receives the external connection information, the management server stores and manages the received external connection information. An external connection monitoring and reporting method, characterized by transmitting a message indicating that the connection has been made. 7. The terminal according to claim 6, wherein the management server monitors the terminal for a dial-up connection monitoring operation of the terminal at regular intervals, and stores and manages the monitoring result therein. The external connection monitoring and reporting method described. 8. An external connection monitoring and notification method in which a plurality of terminals connected to a LAN and a management server are prepared, wherein a program for an external connection monitoring system executed by a processor of the terminal and the management server is prepared. The program of the external connection monitoring system monitors the external connection of the terminal itself by the processor of the terminal, and when detecting the external connection, notifies the terminal managed by the administrator that the external connection has been detected. 1 program, a second program that monitors the aliveness of the first program by the processor of the terminal, and a storage management of the external connection information from the terminal and the second program by the processor of the management server. A third program for accumulating and managing abnormal information due to a cooperation abnormality; A fourth program for notifying and displaying an administrator on the terminal based on the information stored and managed, wherein the processor of the terminal executes the first and second programs when the apparatus is started up. First, the processor of the management server starts executing the third and fourth programs when the device is started up, and the first and second programs are executed.
The processor of the terminal that executes the first program monitors the execution of each of the first and second programs, and restarts the own program if there is an abnormality, and executes the third and fourth programs. And a processor of the management server that monitors the execution of each of the third and fourth programs, and restarts the own program if there is an abnormality. . 9. The processor of the terminal that executes the first program, when detecting disconnection after external connection, transmits the external connection information including connected destination information to the management server. 9. The external connection monitoring and notification method according to claim 8, wherein 10. The processor of the management server that executes the third program, the processor of the terminal executes the second program when cooperating with the second program.
9. The external connection monitoring and notification method according to claim 8, wherein whether the program is executed is monitored, and if the program is abnormal, accumulation management of the abnormality information indicating an abnormality of the terminal is performed.