JP2004342122A - User system monitoring method and remote monitoring system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent wrong intrusion from an external network into a remotely monitored network. <P>SOLUTION: A user network including a user system, an individual monitoring device 32, and a monitored information output device 33 and a manager's network including a monitored information detector 34 and a centralized monitoring device 10 are provided. The monitored information output device 33 and the monitored information detector 34 output monitored information of the user system 31 by using protocols allowing information to be transferred only in one direction from the monitored information output device 33 to the monitored information detector 34. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to a technique for securing network security, and more particularly, to a technique for securing network security in a remote monitoring system.

Background of the Invention

  2. Description of the Related Art A remote monitoring system for monitoring a device such as a computer from a remote place via a network is known. For example, as shown in FIG. 5, a system for remotely monitoring a computer 91 or the like in a user site from a monitoring device 93 at an administrator site is known. The network of the user site and the network of the administrator site are connected by, for example, an IP network 95. The networks are usually connected by a router 92 or the like.

  By the way, in this system, a firewall must be built at the user site in order to ensure security. The firewall can prevent unauthorized intrusion by a third party from the outside, and prevent leakage of information from the inside easily.

  An object of the present invention is to provide a technique for performing remote monitoring while preventing unauthorized intrusion of a network to be remotely monitored from the outside.

  To achieve the above object, according to a first aspect of the present invention, an administrator network connected to a monitoring device and a plurality of user networks connected to a user system are connected to the administrator network from each of the user networks. The monitoring device receives information indicating the status of the user system connected to each of the user networks, and monitors the status of the user system.

  ADVANTAGE OF THE INVENTION According to this invention, a monitoring target can be monitored remotely, preventing illegal intrusion from the outside to the network of the side monitored remotely.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

  FIG. 1 is a diagram showing an overall configuration of a remote monitoring system to which the present invention is applied. In this system, the device at the administrator site 1 and the device at the user site 3 are connected via a network 9 such as an IP network. Then, the administrator monitors the device at the user site 3. In the present embodiment, a plurality of user sites 3 are monitored.

  Each of the user sites 3 is provided with a user system 31, an individual monitoring device 32, a monitoring information output device 33, and a monitoring information detecting device 34. However, some or all of the individual monitoring device 32, the monitoring information output device 33, and the monitoring information detection device 34 may be installed at the administrator site 1. The user system 31, the individual monitoring device 32, and the monitoring information output device 33 form a user network. The monitoring information detecting device 34 and the centralized monitoring device 10 form an administrator network. The connection between the monitoring information output device 33 and the monitoring information detection device 34 will be described later.

  The user system 31 is a system of a user to be monitored. The user system includes, for example, a server / client system including a plurality of computers and a single device having a communication function.

  The individual monitoring device 32 monitors the state of the user system 31. For example, the individual monitoring device 32 checks whether communication with the computer of the user system 31 is possible. For example, when the user system 31 and the individual monitoring device 32 are connected by TCP / IP, whether or not communication is possible depending on whether a response to a ping command transmitted from the individual monitoring device 32 to the user system 31 is made. Is determined. In addition, the individual monitoring device 32 receives a status notification from the user system 31 (for example, a notification of occurrence of an event such as an error, a warning, or abnormal termination of an application). The individual monitoring device 32 may be configured integrally with the monitoring information output device 33.

  The monitoring information output device 33 outputs predetermined monitoring information based on the notification from the individual monitoring device 32. Specifically, the monitoring information output device 33 receives a notification from the individual monitoring device 32 notifying that an event such as an error has occurred in the user system 31. Upon receiving this notification, the monitoring information output device 33 outputs monitoring information that is a signal corresponding to the notification. The monitoring information is output to the monitoring information detecting device 34.

  Here, the monitoring information output device 33 and the monitoring information detection device 34 are connected by a protocol that enables information transfer from the monitoring information output device 33 to the monitoring information detection device 34 in only one direction. Therefore, any information cannot be transferred from the monitoring information detection device 34 to the monitoring information output device 33. As a result, it is possible to prevent unauthorized invasion of the network including the user system 31 from the external network 9.

  Specifically, the monitoring information output device 33 may be, for example, a switch circuit including a plurality of switches configured by a relay circuit. When the monitoring information output device 33 is a switch circuit, the monitoring information is a current that is turned on / off by turning on / off the switch. A switch to be turned on / off according to the event that has occurred is predetermined. The monitoring information output device 33 and the monitoring information detection device 34 may be connected by an RS-232C cable.

  The monitoring information detection device 34 detects the monitoring information output by the monitoring information output device 33. When the monitoring information output device 33 is a switch circuit, the monitoring information detection device 34 includes a current detection circuit and detects a current flowing from the switch circuit.

  The monitoring information detection device 34 includes a monitoring information table 35 shown in FIG. In the monitoring information table 35, the monitoring information 351 is associated with the event 352 that has occurred.

  The monitoring information detection device 34 specifies the event that has occurred with reference to the monitoring information table 35. Then, the monitoring information detection device 34 outputs information for notifying the central management device 10 of an event that has occurred in the user system 31.

  The administrator site 1 includes a centralized monitoring device 10 and a display device 11.

  The centralized monitoring device 10 receives the event notification information sent from the monitoring information detection device 34. Thereby, the centralized monitoring apparatus 10 can centrally manage predetermined events generated in all the user systems 31 to be monitored. Then, the monitoring result can be displayed on the display device 11. The centralized monitoring device 10 can also log the received notification information. In addition to the display on the display device 11, the occurrence of an event may be notified to the administrator by the following method. That is, voice may be output from a speaker (not shown), output to a facsimile apparatus (not shown), displayed on an alarm lamp (not shown), or notified to a subscriber telephone or a mobile phone (not shown). When notifying a subscriber telephone or a mobile phone, the other party may be authenticated before the report.

  When an administrator provides a monitoring service to a user using the system according to the present embodiment, first, the user and the administrator conclude a monitoring contract. Items specified in the contract include, for example, the type of event to be reported, the contract period, the fee, the payment method, and the like. Various information related to the contract is stored in a contract database (not shown) at the administrator site. The individual monitoring device 32, the monitoring information output device 33, and the monitoring information detecting device 34 are installed after the contract is concluded. Thereafter, monitoring of the user system is started.

  Next, a processing procedure in the present system will be described. First, the individual monitoring device 32 performs the processing shown in FIG.

  The individual monitoring device 32 monitors the user system 31 to be monitored (S101). During this time, when the individual monitoring device 32 detects an abnormality of the user system 31 (S102) and receives an abnormality notification from the user system 31 (S103), the individual monitoring device 32 sends the monitoring information to the monitoring information output device 33. Is output (S105). At this time, the individual monitoring device 32 notifies the monitoring information output device 33 of information for identifying the event that has occurred. The above processing is repeated until the monitoring is completed (S104). For example, when the contract has not expired, such as when the contract has expired, the monitoring is terminated.

  FIG. 4 shows a processing procedure after the individual monitoring device 32 outputs the monitoring information output instruction to the monitoring information output device 33.

  The monitoring information output device 33 that has received the instruction from the individual monitoring device 32 outputs the monitoring information to the monitoring information detection device 34 according to the event that has occurred. When the monitoring information detection device 34 is a switch circuit, the switch corresponding to the event that has occurred is turned on.

  The monitoring information detection device 34 receives this monitoring information. Then, the monitoring information detection device 34 uses the monitoring information table 35 to specify an event that has occurred in the user system 31. Thereafter, the monitoring information detection device 34 notifies the centralized management device 10 of the specified event.

  The central management device 10 notifies the administrator of the occurrence of the event. As a result, the administrator can grasp events that have occurred in all the user systems 31.

  Further, the centralized monitoring device 10 performs a process of charging a fee. For example, the centralized monitoring device 10 refers to a contract database (not shown) and detects that the contract is within the validity period and the billing time has come. Then, the centralized monitoring device 10 performs a billing process for the user.

FIG. 1 is an explanatory diagram illustrating a configuration of a network system that performs remote monitoring according to an embodiment to which the present invention is applied. FIG. 7 is a diagram illustrating an example of a monitoring information table 35. 5 is a flowchart illustrating a processing procedure of the individual monitoring device 32. FIG. 9 is an explanatory diagram showing a flow of information between the devices following a monitoring information output instruction. It is an explanatory view showing a configuration of a conventional remote monitoring system.

Explanation of reference numerals

DESCRIPTION OF SYMBOLS 1 ... Administrator site, 3 ... User site, 10 ... Central monitoring device, 9 ... Network, 31 ... User system, 32 ... Individual monitoring device, 33 ... Monitoring information output device, 34 ... Monitoring information detecting device, 35 ... Monitoring information table.

Claims (5)

A plurality of user networks to which an administrator network connected to a monitoring device and a user system are connected so as to be communicable only in one direction from each of the user networks to the administrator network,
A method in which the monitoring device receives information indicating a status of a user system connected to each of the user networks, and monitors the status of the user system. An administrator who monitors the user system and each user enter into a user system status monitoring contract,
The method according to claim 1, wherein the monitoring device monitors the status of the user system of each user only during a valid period of a contract with each user. The monitoring device,
3. The method according to claim 2, wherein the billing process is performed on the user within a valid period of a contract with each user and at a billing time for the user. The monitoring device,
The method according to any one of claims 1 to 3, wherein the information indicating the monitoring result is visually displayed on a display device or output as sound. A plurality of user networks and one administrator network are connected,
Each of the user networks,
A first monitoring device that monitors the user system, and a first connection device that outputs information according to the monitoring result of the user system to the administrator network,
The administrator network comprises:
A second connection device connected to the first connection device of each user network by a protocol capable of transferring information only in one direction, and receiving information indicating a monitoring result from each first connection device; ,
A remote monitoring system comprising: a second monitoring device that monitors a plurality of user systems based on information indicating a monitoring result received by a second connection device.

Images