JP2005286877A - Communication jamming server, communication jamming program, communication jamming method, information communication system, and information communication method - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent an attack to the other computer from a contaminated computer which receives the attack by a computer worm. <P>SOLUTION: An information communication system is provided with a controller server 6 having a means extracting the identifier of a communication jamming server 1a installed in a network segment 10b where the contaminated computer 2 is arranged and transmitting the IP address of the contaminated computer 2 to the extracted communication jamming server 1a, the communication jamming server 1a receiving the IP address of the contaminated computer 2 from the controller server 6, creating a dummy MAC address setting instruction which sets the MAC address of the contaminated computer 2 in a dummy MAC address and transmitting it to a frangible computer 3 present in the same network segment 10b as the contaminated computer 2, and information equipment rewriting the MAC address corresponding to the IP address of the contaminated computer 2 into the dummy MAC address. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a communication blocking server, a communication blocking program, a communication blocking method, an information communication system, and an information communication method for preventing an attack from an infected computer that has been attacked by a computer worm to another computer.

  With the development of computer networks in recent years, unauthorized access such as computer worms, viruses, hacking and the like has also increased, and confidential information may be leaked or a denial of service attack may occur via the computer network. Examples of the computer worm include Nimda, Code Red, and the like, and attack the computer by targeting a bug called a security hole of an operation system or software installed in the computer. Computer worms with high infection speed and high risk are frequently generated, and can cause enormous damage.

  However, appropriate security measures are indispensable to ensure the safety while enjoying the convenience of the network. In particular, organizations such as companies and organizations are required to take measures against unauthorized access by providing a firewall or installing anti-virus software against such unauthorized access.

  However, in a computer network that employs TCP / IP, the firewall determines whether to permit communication based on the IP address and port number of the transmission source, so it is difficult to ensure safety with security measures using only the firewall. It has become. Based on this, expectation for IDS (Intrusion Detection System) that monitors communications that have passed through firewalls and detects intrusion of unauthorized access, and IDP (Intrusion Detection and Prevention) that protects servers to be protected from intrusion Is growing.

  In addition, in order to cope with unauthorized access such as DDoS, there is an unauthorized access protection system that, when a DDoS attack is detected, issues a communication control instruction to an attack blocker according to an instruction from the administrator of the defending network (for example, Patent Documents). 1). In the unauthorized access protection system described in Patent Document 1, a bastion host equipped with a DDoS attack program controls communication when receiving a communication control instruction.

On the other hand, when a MAC address inquiry request is received, there is a network bridge device that can reduce traffic in the LAN and take security measures by returning the MAC address that has received the inquiry request as an ARP server. (Patent Document 2). The network bridge device described in Patent Document 2 includes an address table in which a MAC address and an IP address are registered in advance in association with each other, and returns a MAC address with reference to the address table.
JP 2002-158660 A JP 2003-319955 A

  However, since IDP protects a server to be protected, it is impossible to protect all information devices existing in a communication network such as an in-house intranet with IDP.

  For example, in many cases, a computer can protect against unauthorized access by always obtaining the latest virus pattern file for anti-virus software and applying a correction file for correcting a security hole. However, in order to protect all the computers existing on the communication network of the organization, it must be strictly managed in exchange for a great deal of cost and labor. Therefore, it is virtually impossible to protect all computers from unauthorized access by managing virus pattern files and managing modified files, and the vulnerability of unmanaged computers becomes high.

  Therefore, when unauthorized access enters a communication network and infects a computer, there is a problem that damage is further increased by targeting a highly vulnerable computer.

  In addition, the system described in Patent Document 1 described above is an effective system for unauthorized access that takes time and causes damage such as a DDoS attack. However, since computer worms such as Nimda and Code Red perform destructive activities while repeating self-replication, there is a problem that the damage spreads instantly once infected.

  In the device described in Patent Document 2 described above, the MAC address is periodically inquired, and when the responded MAC address is extracted and does not match the one registered in the address table, a warning mail is transmitted. It is thought that security measures are taken. The apparatus described in Patent Document 2 is a security measure effective when the computer MAC address is changed, and is not a security measure against a computer worm.

  Accordingly, an object of the present invention is to provide a communication blocking server, a communication blocking program, a communication blocking method, an information communication system, and an information communication method that prevent an attack from an infected computer that has been attacked by a computer worm to another computer. .

  In order to solve the above-mentioned problem, the communication blocking server according to the first aspect of the present invention comprises means for receiving an IP address of an infected computer attacked by a computer worm and storing it in a storage device as an infected computer IP address. Reads out the infected computer IP address from the storage device, creates a dummy MAC address setting command for setting the MAC address of the infected computer as a dummy MAC address, and the dummy MAC address setting command exists in the same network segment as the infected computer Means for transmitting to the information equipment. As a result, the communication jamming server according to the first feature of the present invention does not establish a communication connection between an infected computer and a device existing in the same network segment as the infected computer.

  Here, the dummy MAC address is preferably a word that does not correspond to any MAC address of the information device existing in the network segment, or a MAC address of the communication disturbing server. As a result, the attack packet transmitted from the infected computer cannot be transmitted to another information device.

  Further, a means for receiving a request for inquiring a MAC address based on a predetermined IP address, and if the predetermined IP address is an infected computer IP address, generate a reply for the request associating the infected computer IP address with a dummy MAC address. And a means for transmitting. According to this, even when a plurality of computers are infected, it is possible to cope with it.

  The communication jamming server according to the second aspect of the present invention receives an IP address of an infected computer that has been attacked by a computer worm, stores the IP address of the infected computer in the storage device as an infected computer IP address, and transmits the infected computer IP address from the storage device. To create a dummy MAC address setting command for setting the MAC address of the infected computer to a dummy MAC address, and to transmit the dummy MAC address setting command to an information device in the same network segment as the infected computer. By causing the computer to execute, a communication connection between the infected computer and a device existing in the same network segment as the infected computer is not established.

  Furthermore, it is preferable that the dummy MAC address is a word that does not correspond to any MAC address of the information device existing in the network segment, or the MAC address of the communication blocking server.

  Furthermore, a step of receiving a request for inquiring about a MAC address based on a predetermined IP address, and if the predetermined IP address is an infected computer IP address, generate a reply for the request associating the infected computer IP address with a dummy MAC address. It is preferable to further cause the computer to execute the transmitting step.

  According to a third aspect of the present invention, there is provided a communication blocking method comprising: receiving an IP address of an infected computer that has been attacked by a computer worm; storing the IP address of the infected computer as an infected computer IP address in a storage device; To create a dummy MAC address setting command for setting the MAC address of the infected computer to a dummy MAC address, and to transmit the dummy MAC address setting command to an information device in the same network segment as the infected computer. The communication connection between the infected computer and the device existing in the same network segment as the infected computer is not established.

  The information communication system according to the fourth aspect of the present invention reads a communication jamming server list in which an identifier of a network segment and an identifier of a jamming server installed in the network segment are associated with each other, and uses a computer worm. Obtain the IP address of the infected computer that was attacked, determine the network segment where the infected computer was installed based on the IP address of the infected computer, and identify the communication blocking server installed in the network segment where the infected computer was installed A controller server having means for transmitting the IP address of the infected computer to the extracted communication blocking server, and receiving the IP address of the infected computer from the controller server, And storing the infected computer IP address from the storage device, creating a dummy MAC address setting command for setting the infected computer's MAC address to the dummy MAC address, and infecting the dummy MAC address setting command A communication jamming server comprising means for transmitting to an information device existing in the same network segment as the computer, and a dummy MAC address setting command installed in the same network segment as the infected computer and transmitted from the communications jamming server; Reads the ARP table in which the IP address and MAC address of the information device existing in the same network segment are associated, and rewrites the MAC address corresponding to the infected computer IP address to a dummy MAC address And an information apparatus equipped with the stage.

  In the information communication method according to the fifth aspect of the present invention, the controller server reads from the storage device a communication jamming server list in which the identifier of the network segment is associated with the identifier of the jamming server installed in the network segment. Obtaining the IP address of the infected computer that has been attacked by the computer worm, and the controller server determines the network segment in which the infected computer is installed based on the IP address of the infected computer, and the network in which the infected computer is installed Extracting an identifier of a communication jamming server installed in the segment; a controller server transmitting an IP address of an infected computer to the extracted communication jamming server; Receiving the IP address of the infected computer from the roller server, means for the communication blocking server to store the infected computer IP address in the storage device, and reading out the infected computer IP address from the storage device to dummy the MAC address of the infected computer Creating a dummy MAC address setting command for setting a MAC address; a step for sending a dummy MAC address setting command to an information device in the same network segment as the infected computer; The step of receiving the dummy MAC address setting command transmitted from the jamming server and the information device read the ARP table in which the IP address and the MAC address of the information device existing in the same network segment are associated with each other. And rewriting the MAC address corresponding to the infected computer IP address to a dummy MAC address.

  According to the present invention, it is possible to provide a communication blocking server, a communication blocking program, a communication blocking method, an information communication system, and an information communication method that prevent an attack from an infected computer that has been attacked by a computer worm to another computer.

  Next, embodiments of the present invention will be described with reference to the drawings. In the following description of the drawings, the same or similar parts are denoted by the same or similar reference numerals.

(Best Embodiment)
As shown in FIG. 1, the information communication system according to the preferred embodiment of the present invention includes, for example, a first network segment 10a and a second network segment 10b, and the first network segment 10a includes The communication blocking server 1b is connected to the second network segment 10b. The first network segment 10 a and the second network segment 10 b are connected to each other via the router 5. The first network segment 10a and the second network segment 10b communicate based on TCP-IP.

  Connected to the first network segment 10a are an IDS device 7 and an IDP device 8, a controller server 6, and an obstruction server 1b that detect intrusion of unauthorized access to the first network segment 10a. Further, a web server 9 protected by the IDP device 8 is connected to the IDP device 8. Connected to the second network segment 10b are an infected computer 2 infected by an invading computer worm, a vulnerable computer 3 with weak management of security patches and virus pattern files, a computer 4, and a communication blocking server 1a.

  Here, the IP address “M” is assigned to the first communication blocking server 1a, the IP address “N” is assigned to the second communication blocking server 1b, and the IP address “A” is assigned to the infected computer 2. Suppose that Further, it is assumed that the MAC address of the infected computer 2 is “MAC_A”. Assume that the router 5 installed at the boundary between the first network segment 10a and the second network segment 10b includes an ARP table 51a as shown in FIG. In the ARP table 51a, the MAC address “MAC_A” is associated with the IP address “A” of the infected computer 2. Other information devices also have an ARP table as shown in FIG.

  The controller server 6 is a server that obtains information on unauthorized access detected by the IDS device 7 and the IDP device 8 and issues a command to block communication to the communication blocking servers 1a and 1b.

  The controller server 6 includes a communication blocking server list 61 in which an identifier of a network segment is associated with an identifier of a communication blocking server installed in the network segment. The communication blocking server list 61 can be read by the controller server 6. Stored in a built-in or external storage device. In the communication blocking server list 61, as shown in FIG. 3, the IP address “N” of the communication blocking server 1b is associated with the “first network segment”.

  The controller server 6 reads out the communication blocking server list 61 from the storage device, acquires the IP address (A) of the infected computer 2 attacked by the computer worm, and based on the IP address (A) of the infected computer Determine the network segment in which is installed. Here, the controller server 6 determines that the infected computer 2 is installed in the second network segment 10b. Further, the controller server 6 extracts the identifier of the communication jamming server 1b installed in the second network segment 10b in which the infected computer 2 is installed, and sends the IP address of the infected computer 2 to the extracted communications jamming server 1b. (A) is transmitted.

  The communication blocking server 1 a receives the IP address (A) of the infected computer 2 from the controller server 6 and stores it in the storage device 107 as the infected computer IP address 11. The communication blocking server 1a reads the infected computer IP address 11 from the storage device 107, creates a dummy MAC address setting command for setting the MAC address of the infected computer to a dummy MAC address, and the same network segment 10b as the infected computer 2 A dummy MAC address setting command is transmitted to information devices such as the infected computer 2, the vulnerable computer 3, and the router 5 existing in the network.

  When the information device such as the infected computer 2, the vulnerable computer 3, and the router 5 receives the dummy MAC address setting command transmitted from the communication blocking server 1a, the IP address and MAC address of the information device existing in the same network segment 10b are set. Is read, and the MAC address corresponding to the infected computer IP address is rewritten to a dummy MAC address.

  Here, with reference to FIG. 4, the flow of processing of the information communication system according to the best mode of the present invention will be described.

  When the intrusion of the computer worm is detected by the IDS device 7 or the IDP device 8, first, in step S101, the controller server 6 acquires the IP address (A) of the infected computer 2 infected with the computer worm. In step S102, the network segment to which the infected computer 2 belongs is specified, and the communication blocking server 1a installed in the network segment is searched from the communication blocking server list 61. Furthermore, in step S103, the controller server 6 transmits the IP address (A) of the infected computer 2 to the communication blocking server 1a searched in step S102, and transmits a command for blocking the communication of the infected computer 2.

  Upon receiving the obstruction instruction, the communication obstruction server 1a broadcasts the obstruction instruction to information devices installed in the same network segment 10b, that is, the vulnerable computer 3 and the router 5 in steps S104a and S104b. Specifically, the Gratuitous ARP is transmitted so that the MAC address corresponding to the IP address (A) of the infected computer 2 is changed to “MAC_X” which is a dummy MAC address.

  When receiving the obstruction command, the vulnerable computer 3 and the router 5 etc., in step S105a and step S105b, set the MAC address corresponding to the IP address (A) of the infected computer 2 to the dummy MAC address with respect to the ARP table stored in advance. To “MAC_X”. For example, the router 5 changes the MAC address corresponding to the IP address “A” of the infected computer 2 to “MAC_A” as in the ARP table 51b of FIG.

  On the other hand, the infected computer 2 tries to send an attack packet to the vulnerable computer 3 as a new infection destination.

  More specifically, the infected computer 2 transmits a SYN (connection request) packet to establish a communication connection between the infected computer 2 and the vulnerable computer 3 in order to transmit an attack packet to the vulnerable computer 3 in step S106. try to.

  On the other hand, the vulnerable computer 3 tries to transmit a SYN_ACK (connection request confirmation) packet, which is a response to the SYN packet, to the infected computer 2 in step S107. At this time, the vulnerable computer 3 reads the ARP table provided in the vulnerable computer 3 and transmits a SYN_ACK packet to the MAC address “MAC_X” of the infected computer 2. However, since the MAC address “MAC_X” does not exist on the second network segment 10b, the SYN_ACK packet does not reach the infected computer 2.

  Accordingly, since the infected computer 2 cannot transmit an ACK (acknowledgment) packet to the vulnerable computer 3, a communication connection is not established between the infected computer 2 and the vulnerable computer 3. Thereby, since the infected computer 2 cannot transmit the attack packet to the vulnerable computer 3, the vulnerable computer 3 is not infected with the computer worm from the infected computer 2. Since the infected computer 2 cannot establish a communication connection with information devices other than the vulnerable computer 3, secondary infection by the infected computer 2 can be prevented.

Further, the communication blocking server 1a makes a response to the ARP request transmitted on the network segment 10b.
As shown in FIG. 6, in step S201a to step S201d, the computer 4 existing on the network segment 10b sends the MAC corresponding to the IP address “A” of the infected computer 2 to all the information devices existing on the network segment 10b. An ARP request for inquiring an address is transmitted. At that time, the communication blocking server 1 a transmits an ARP reply having a dummy MAC address “MAC_X” as the MAC address corresponding to the IP address “A” of the infected computer 2 to the computer 4.

  Thereby, it is possible to prevent a communication connection from being established between the computer 4 and the infected computer 2.

  Here, the communication jamming server 1a according to the preferred embodiment of the present invention will be described in detail.

  As shown in FIG. 7, the communication blocking server 1a according to the preferred embodiment of the present invention includes an infected computer IP address 11, a dummy MAC address correspondence table 12, a target IP address 13, an infected computer address notification receiving unit 31, a dummy MAC. Address setting command transmission means 32, ARP request reception means 33, and ARP reply transmission means 34 are provided.

  As shown in FIG. 8, the communication jamming server 1a according to the preferred embodiment of the present invention includes a central processing control device 101, a ROM (Read Only Memory) 102, a RAM (Random Access Memory) 103, and an input / output interface 109. Are connected via a bus 110. An input device 104, a display device 105, a communication control device 106, a storage device 107, and a removable disk 108 are connected to the input / output interface 109.

  The central processing control device 101 reads out and executes a boot program for starting the communication jamming server 1 a from the ROM 102 based on an input signal from the input device 104, and further reads out an operating system stored in the storage device 107. Further, the central processing control device 101 controls various devices based on input signals from the input device 104, the communication control device 106, etc., and reads programs and data stored in the RAM 103, the storage device 107, etc. into the RAM 103. A processing device that loads and implements a series of processes to be described later, such as data calculation or processing, based on a program command read from the RAM 103.

  The input device 104 includes input devices such as a keyboard and a mouse through which an operator inputs various operations. The input device 104 generates an input signal based on the operation of the operator, and inputs via the input / output interface 109 and the bus 110. It is transmitted to the central processing control apparatus 101. The display device 105 is a CRT (Cathode Ray Tube) display, a liquid crystal display, or the like. The display device 105 receives an output signal to be displayed on the display device 105 from the central processing control device 101 via the bus 110 and the input / output interface 109. It is a device that displays the processing result of the control device 101 and the like. The communication control device 106 is a device such as a LAN card or a modem, and is a device that connects the communication blocking server 1a to a communication network such as the Internet or a LAN. Data transmitted / received to / from the communication network via the communication control device 106 is transmitted / received to / from the central processing control device 101 via the input / output interface and bus 110 as an input signal or an output signal.

  The storage device 107 is a magnetic disk device, and stores programs and data executed by the central processing control device 101. The removable disk 108 is an optical disk or a flexible disk, and signals read / written by the disk drive are transmitted / received to / from the central processing control apparatus 101 via the input / output interface 109 and the bus 110.

  The storage device 107 of the communication blocking server 1a according to the first embodiment of the present invention stores a communication blocking program, and also stores an infected computer IP address 11, a dummy MAC address correspondence table 12, and a target IP address 13. Is done. Further, when the communication jamming program is read and executed by the central processing control device 101 of the communications jamming server 1a, the infected computer address notification receiving means 31, the dummy MAC address setting command transmitting means 32, the ARP request receiving means 33, and the ARP reply The transmission means 34 is mounted on the communication blocking server 1a.

  The infected computer address notification receiving means 31 receives the IP address (A) of the infected computer 2 that has been attacked by the computer worm, and stores it in the storage device 107 as the infected computer IP address 11.

  The dummy MAC address setting command transmission means 32 reads the infected computer IP address 11 from the storage device 107 and creates a dummy MAC address setting command for setting the MAC address of the infected computer 2 to the dummy MAC address “MAC_X”. A MAC address setting command is transmitted to an information device existing in the same network segment as the infected computer. Here, the “dummy MAC address” is a word that does not correspond to any MAC address of the information device existing in the network segment. Specifically, the dummy MAC address setting command transmission means 32 generates a Gratuitous ARP 21 that sets the MAC address of the infected computer 2 to the dummy MAC address “MAC_X”, and broadcasts it to the information devices existing in the network segment 10b. .

  At this time, the dummy MAC address setting command transmission unit 32 may include a dummy MAC address correspondence table 12 in which the IP address of the infected computer 2 is associated with the MAC address assigned to the infected computer 2.

  Specifically, the dummy MAC address correspondence table 12 includes an IP address “A” of the infected computer 2, a true MAC address “MAC_A” of the infected computer 2, and “MAC_X” assigned to the infected computer 2 as shown in FIG. Are stored in the storage device 107 in association with each other. At this time, it is preferable that the time at which the Gratuitous ARP 21 is transmitted is also associated.

  The ARP request receiving unit 33 receives the ARP request 22 that inquires about the MAC address based on a predetermined IP address. The ARP request receiving unit 33 extracts the target IP address 13 as a target from the ARP request 22 and stores it in the storage device 107.

  The ARP reply transmission unit 34 reads the target IP address 13 from the storage device 107 and, when the predetermined IP address 13 is an infected computer IP address, an ARP reply 23 for a request for associating the infected computer IP address with a dummy MAC address. Generate and send.

  At this time, the dummy MAC address correspondence table 12 is read from the storage device 107 to determine whether or not the target IP address 13 is registered in the dummy MAC address correspondence table 12. If registered, the ARP reply transmission unit 34 returns a dummy MAC address associated with the target IP address 13. On the other hand, when not registered, the ARP reply transmission means 34 generates and transmits the ARP reply 23 based on the information stored in the ARP table (not shown) included in the ARP reply transmission unit 34.

  As a result, the communication jamming server 1a according to the best embodiment of the present invention can prevent the infected computer 2 and the infected computer 2 from establishing a communication connection between devices existing in the same network segment. Therefore, the communication blocking server 1a according to the best embodiment of the present invention can prevent secondary damage from the infected computer 2.

  Further, the communication blocking server 1a in the best mode of the present invention does not establish a communication connection by associating the dummy MAC address with the IP address of the infected computer 2. As described above, the communication jamming server 1a in the best mode of the present invention is effective in a network segment communicated by a MAC address, that is, a network segment not exceeding a router. Therefore, it is preferable to provide a disturbing server for each network segment separated by a router.

(Modification of the best embodiment)
The communication jamming server 1a according to the modified example of the best embodiment of the present invention transmits the Gratuitous ARP 21 in which the MAC address of the communication jamming server 1a itself is set as a dummy MAC address.

  According to the communication jamming server 1a according to the modification of the best mode of the present invention, the infected computer 2 establishes a communication connection with the communication jamming server 1a and transmits an attack packet to the communication jamming server 1a. Since the attack packet is received by the communication blocking server 1a itself, transmission of the attack packet to other information devices can be prevented. Further, when the communication blocking server 1a receives the attack packet, the communication blocking server 1a may respond based on the frequency of receiving the attack packet or the content of the attack packet.

(Other embodiments)
As described above, the present invention has been described according to the best mode for carrying out the invention. However, it should not be understood that the description and drawings constituting a part of this disclosure limit the present invention. From this disclosure, various alternative embodiments, examples, and operational techniques will be apparent to those skilled in the art.

  For example, in the best mode of the present invention, it has been described that information devices such as the controller server, the IDS device 7, the IDP device 8, and the communication blocking servers 1a and 1b are realized on different hardware. The functions of a plurality of arbitrary information devices may be provided on one piece of hardware.

  It goes without saying that the present invention includes various embodiments not described herein. Therefore, the technical scope of the present invention is defined only by the invention specifying matters according to the scope of claims reasonable from the above description.

1 is a system configuration diagram of an information communication system according to a best embodiment of the present invention. It is an example of the ARP table with which the information equipment which concerns on the best embodiment of this invention is provided, Comprising: It is an example of the ARP table before an infected computer is detected. It is an example of the data structure and data of a communication jamming server list with which the controller server which concerns on best embodiment of this invention is provided. It is a sequence diagram which shows the process of the information communication system which concerns on the best embodiment of this invention. It is an example of the ARP table with which the information equipment which concerns on the best embodiment of this invention is provided, Comprising: It is an example of the ARP table after an infected computer is detected. In the information communication system which concerns on the best embodiment of this invention, it is a sequence diagram which shows a process when an ARP request | requirement is transmitted from the predetermined | prescribed computer. It is a functional block diagram of the communication disturbance server which concerns on the best embodiment of this invention. It is a hardware block diagram of the communication jamming server which concerns on the best embodiment of this invention. It is an example of the data structure and data of a dummy MAC address correspondence table with which the communication jamming server according to the preferred embodiment of the present invention is provided.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1a, 1b ... Communication obstruction server 2 ... Infected computer 3 ... Vulnerable computer 4 ... Computer 5 ... Router 6 ... Controller server 7 ... IDS apparatus 8 ... IDP apparatus 9 ... Web server 10a, 10b ... Network segment 11 ... Infected computer IP address 12 ... Address correspondence table 13 ... Target IP address 21 ... Gratuious ARP
22 ... ARP request 23 ... ARP reply 31 ... infected computer address notification reception means 32 ... address setting command transmission means 33 ... ARP request reception means 34 ... ARP reply transmission means 51a, 51n ... ARP table 61 ... communication blocking server list 101 ... center Processing control device 102... ROM
103 ... RAM
104 ... Input device 105 ... Display device 106 ... Communication control device 107 ... Storage device 108 ... Removable disk 109 ... Input / output interface 110 ... Bus

Claims (9)

Means for receiving an IP address of an infected computer attacked by a computer worm and storing it in a storage device as an infected computer IP address;
Reading the infected computer IP address from the storage device, creating a dummy MAC address setting command for setting the MAC address of the infected computer as a dummy MAC address, and sending the dummy MAC address setting command to the same network as the infected computer Means for transmitting to information equipment existing in the segment,
A communication blocking server that does not establish a communication connection between the infected computer and a device that exists in the same network segment as the infected computer.   The communication jamming server according to claim 1, wherein the dummy MAC address is a word that does not correspond to any MAC address of an information device existing in the network segment, or a MAC address of the communication jamming server. Means for receiving a request to query a MAC address based on a predetermined IP address;
When the predetermined IP address is the infected computer IP address, it further comprises means for generating and transmitting a reply for the request associating the infected computer IP address with the dummy MAC address. Item 3. The communication jamming server according to item 1 or 2. Receiving an IP address of an infected computer attacked by a computer worm and storing it in a storage device as an infected computer IP address;
Reading the infected computer IP address from the storage device, creating a dummy MAC address setting command for setting the MAC address of the infected computer as a dummy MAC address, and sending the dummy MAC address setting command to the same network as the infected computer A communication connection between the infected computer and a device existing in the same network segment as the infected computer by causing the computer to execute the step of transmitting to the information device existing in the segment. Interfering program. The communication jamming program according to claim 4, wherein the dummy MAC address is a word that does not correspond to any MAC address of an information device existing in the network segment, or a MAC address of the communications jamming server. . Receiving a request to query a MAC address based on a predetermined IP address;
When the predetermined IP address is the infected computer IP address, the computer is further caused to generate and send a reply to the request that associates the infected computer IP address with the dummy MAC address. The communication jamming program according to claim 4 or 5. Receiving an IP address of an infected computer attacked by a computer worm and storing it in a storage device as an infected computer IP address;
Reading the infected computer IP address from the storage device, creating a dummy MAC address setting command for setting the MAC address of the infected computer as a dummy MAC address, and sending the dummy MAC address setting command to the same network as the infected computer Transmitting to information equipment existing in the segment,
A communication blocking method, wherein a communication connection between the infected computer and a device existing in the same network segment as the infected computer is not established. Reading a communication blocking server list in which a network segment identifier and an identifier of a communication blocking server installed in the network segment are associated with each other, obtaining an IP address of an infected computer attacked by a computer worm, The network segment in which the infected computer is installed is determined based on the IP address of the infected computer, the identifier of a communication blocking server installed in the network segment in which the infected computer is installed, and the extracted communication blocking A controller server comprising means for transmitting the IP address of the infected computer to the server;
Means for receiving an IP address of the infected computer from the controller server and storing it in a storage device as an infected computer IP address; reading the infected computer IP address from the storage device; and setting the MAC address of the infected computer as a dummy MAC address Creating a dummy MAC address setting command to be set, and a means for transmitting the dummy MAC address setting command to an information device existing in the same network segment as the infected computer,
When receiving the dummy MAC address setting command installed in the same network segment as the infected computer and transmitted from the communication blocking server, the IP address and MAC address of the information device existing in the same network segment are associated with each other. An information communication system comprising: an information device that reads a read ARP table and rewrites a MAC address corresponding to the infected computer IP address with the dummy MAC address. The controller server reads from the storage device a communication blocking server list in which the identifier of the network segment and the identifier of the communication blocking server installed in the network segment are associated, and the IP address of the infected computer that has been attacked by the computer worm Step to get the
The controller server determining a network segment in which the infected computer is installed based on an IP address of the infected computer, and extracting an identifier of a communication blocking server installed in the network segment in which the infected computer is installed; ,
The controller server transmitting the IP address of the infected computer to the extracted communication jamming server;
The communication jamming server receiving an IP address of the infected computer from the controller server;
The communication blocking server stores in the storage device as an infected computer IP address, and reads out the infected computer IP address from the storage device and sets the MAC address of the infected computer as a dummy MAC address. The steps of creating
The communication jamming server transmits the dummy MAC address setting command to an information device existing in the same network segment as the infected computer;
The information device receiving the dummy MAC address setting command transmitted from the communication jamming server;
The information device reads an ARP table in which the IP address and MAC address of the information device existing in the same network segment are associated, and rewrites the MAC address corresponding to the infected computer IP address to the dummy MAC address. An information communication method comprising the steps of:

Images