JP2006237779A - Computer monitor system, monitor method and monitor program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To detect an incorrectly connected computer by monitoring a network while attaining the specification of the place of the computer and a shutting-out from the network. <P>SOLUTION: A MAC address contained in a packet flowing on an intra-net is monitored by a monitor server, and an incorrect connection is detected by a comparison with a database on which the MAC address of a previously connectable terminal is registered. When the incorrect connecting terminal is detected, a positional information is required to the terminal, and a supervisor is dispatched on the basis of the replied positional information while the stop of a network connecting function is required to the terminal. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a system for remotely monitoring a plurality of computers installed in a company or a school, and in particular, determines whether or not a computer is permitted to connect using a MAC address of each computer, and a computer without permission. The present invention relates to a monitoring system, a monitoring method, and a monitoring program for prohibiting network connection and enabling dispatch of personnel by specifying a position.

  As a prior art by the inventor of the present application, an operation confirmation signal is periodically transmitted to each computer connected to the network to check whether there is a failure. If a failure has occurred, the computer acquires location information from the GPS or the like. There is a system and a method in which a maintenance staff can be dispatched by adding a reply to failure information (for example, Patent Document 1).

  In addition, it is proposed that in a dial-up router, when automatic connection is repeated periodically more than a preset number of times, it is determined that the connection is unauthorized, and prohibition of automatic connection is set (for example, Patent Document 2).

  In addition, as a method of detecting a device that is illegally connected on the network, the contents of the ARP (Address Resolution Protocol) table at the normal time and during the fraud monitoring are compared, and either the IP address or the MAC address is different. It is disclosed that it is determined as an unauthorized connection device (for example, Patent Document 3).

JP 2004-246759 A Japanese Patent Laid-Open No. 2002-217953 JP 2002-325077 A

  However, the technique of the above-mentioned patent document 1 is aimed at speeding up the failure recovery in each terminal, and is not aimed at finding and shutting out unauthorized use of network assets. Patent Document 2 relates to an unauthorized connection detection method unique to dial-up connection, and is not applicable to unauthorized connections on the Ethernet such as an in-house LAN or a campus LAN. Moreover, although it is disclosed in the invention described in Patent Document 3 that the MAC address is used, since it is a configuration in which all devices connected at the beginning (first period) are grasped as normal connection devices, it is illegal at this time. There is a problem that if there is a connected device, it cannot be detected and countermeasures taken.

  The computer monitoring system and the monitoring method thereof according to the present invention monitor a packet flowing through a network to identify an illegally connected computer from a MAC address, and attain the location of the computer and shut out from the network. The purpose is to effectively prevent unauthorized use of assets.

  In order to achieve the above object, the present invention provides a system for monitoring a computer connected to a local area network, a database in which MAC addresses of computers permitted to be connected in advance are registered, and a packet sent over the network. The most important feature is that it includes a monitoring server that monitors and determines an unauthorized connection when the MAC address contained therein is not registered in the database.

  In addition, the computer monitoring system of the present invention includes one or more computer terminals installed by a user, and the monitoring server issues a connection stop request to a computer terminal determined to be an unauthorized connection, and the computer terminal receives the stop request. And a network connection means for stopping the network connection function in the event of a failure.

  In the computer monitoring system of the present invention, the monitoring server requests the computer terminal determined to be unauthorized connection to transmit the position information, and the computer terminal includes means for acquiring the position information of the own terminal. When the request is received, the acquired position information is transmitted to a designated destination.

  In a preferred embodiment, the position information acquisition means of the computer terminal includes GPS signal reception means.

  The computer monitoring system of the present invention further includes an information communication terminal belonging to a security officer, and the location information of the computer terminal from the monitoring server or the computer terminal determined to be the unauthorized connection is the information communication terminal of the security officer. It is transmitted to.

  The method according to the present invention is a monitoring method of a system for monitoring a computer connected to a local area network, wherein a monitoring server connected to the network monitors packets sent over the network and permits connection in advance. A step of determining an unauthorized connection when the MAC address included in the packet is not registered in a database in which the MAC address of the registered computer is registered, and a connection stop request to the computer terminal determined to be an unauthorized connection by the monitoring server Transmitting.

  The monitoring method of the present invention further includes a step in which the monitoring server requests the location information from a computer terminal determined to be an unauthorized connection.

  According to the monitoring method of the present invention, the computer terminal connected to the network stops the network connection function when receiving a connection stop request from the monitoring server, and the computer terminal acquires location information of the terminal. And a step of transmitting the acquired location information to a specified destination when the computer terminal receives a request for location information from the monitoring server.

  The program according to the present invention is a monitoring server program for monitoring a computer connected to a local area network, wherein the monitoring server monitors a packet sent to the network, and a MAC of a computer that is permitted to connect in advance. Executing a step of determining an unauthorized connection when a MAC address included in the packet is not registered in a database in which an address is registered, and a step of transmitting a connection stop request to a computer determined to be an unauthorized connection. It is characterized by.

  The program according to the present invention may further cause the monitoring server to execute a step of requesting the computer determined to be unauthorized connection to transmit the position information.

  By monitoring a packet transmitted on the local area network and detecting a packet including a MAC address other than a MAC address permitted in advance, the network is determined by determining that the transmission source of the packet is an illegally connected computer. It is possible to immediately detect an unauthorized connection to and take appropriate action.

  In addition, if an illegally connected terminal is detected, the network function of that terminal is stopped, preventing access to important data on the network from an illegally connected device or operations that cause a major failure to the network. When implemented in conjunction with various other security measures, the security level of companies and organizations can be kept high.

  In addition, by acquiring the location information of the unauthorized connection terminal and transmitting it to the mobile information communication terminal of the monitor, the monitor can rush to the site of the unauthorized connection and give advice and recommendations. Risk of leakage can be minimized. At the same time, it is possible to give immediate attention and recommendations to users of unauthorized connection terminals, prevent repeated continuation of unauthorized connections by the users, and effectively guide unauthorized connection rates by instructing network connection policies. Can be reduced.

  In this case, the position information acquisition means on the computer side can suitably use the GPS position information, and this has the effect that it is possible to acquire position information with a high system.

  Hereinafter, the best mode for carrying out the present invention will be described in detail with reference to the drawings.

  FIG. 1 is a diagram showing a configuration of an embodiment of a computer monitoring system according to the present invention. Referring to the figure, an intranet 100 (LAN or WAN) constructed in a company or a school has a plurality of user terminals 10, a monitoring server 20 that monitors packets sent from each user terminal 10 on the network, and a company And a supervisor terminal 30 referred to by a security officer such as a school.

  The user terminal 10 is a computer that is provided to its members in a company, a computer that is installed in a school and can be freely used by students and teachers, and can be portable if it is a fixed desktop type. It does not matter whether it is a laptop type that can be connected to the intranet 100 from an appropriate place in the company or on campus. These user terminals 10 have a network connection function, and can connect to the intranet 100 and use resources on the network (for example, access to a shared file and a mail function). Further, as will be described later, it has a function of receiving a request from the monitoring server 20 and stopping the network connection function, and a function of acquiring the position of its own terminal and transmitting it to the monitoring server 20.

  FIG. 2 shows a schematic configuration of the user terminal 10. The user terminal 10 includes a connection unit 101 for connecting to the intranet 100, a transmission processing unit 102 that transmits location information to a designated destination in response to a request from the monitoring server 20, and a GPS signal reception that acquires the location information. Means 103. The connection unit 101 is an information processing apparatus such as a network card, and is responsible for network connection of the user terminal 10. This connection means 101 has a unique MAC address (Media Access Control Address) for each apparatus, and this MAC address is added to a data packet sent from the user terminal 10 to the network 100. Further, the connection unit 101 stops the network connection function when receiving a connection stop request from the monitoring server 20. The connection unit 101 treats the connection stop request from the monitoring server 20 as the highest priority, and when receiving the request, transmission / reception of packets via the network 100 is blocked.

  When receiving the location information transmission request from the monitoring server 20, the transmission processing unit 102 of the user terminal 10 acquires the location information from the GPS signal receiving unit 103 and transmits it to the designated destination. In this embodiment, the position information destination is described as the monitor terminal 30. The GPS signal receiving unit 103 receives a satellite signal of a known satellite navigation system, derives the position of the terminal from the satellite signal, and notifies the transmission processing unit 102 of it. Since GPS (Gloval Positioning System) is well-known, the detailed description is abbreviate | omitted in this specification. Although not shown, it is assumed that the user terminal 10 is provided with necessary functions (software and hardware) for connecting to a network and performing business.

  The monitoring server 20 is, for example, a workstation type server computer connected to the intranet 100. The monitoring server 20 sniffs a packet flowing on the network 100, and compares the MAC address included in the packet with a MAC address permitted to connect in advance. This is an apparatus for detecting unauthorized connection.

  As shown in FIG. 3, the monitoring server 20 includes a processing device 201 and a MAC address DB 202. In the MAC address DB 202, a MAC address that is information unique to a terminal permitted to connect to the intranet 100 is registered. Although not shown, the monitoring server 20 includes a router or hub device connected to the intranet 100, and the router or hub device extracts a MAC address included in a packet flowing on the network 100 and notifies the processing device 201. To do. The processing device 201 refers to the MAC address DB 202 to check whether or not the notified MAC address is registered in the database 202. If the MAC address is not registered, the processing device 201 determines that the connection is unauthorized by a terminal that is not permitted to connect. When an unauthorized connection terminal is detected, a request for transmitting location information is sent to the terminal, and then a network connection stop request is sent. In this case, the position information transmission request includes the destination address information of the monitor terminal 30, and the user terminal 10 transmits the position information directly to the monitor terminal 30 that is the designated destination.

  However, in another embodiment, the user terminal 10 may return the position information to the monitoring server 20, and the monitoring server 20 may transfer the position information to the monitor terminal 30. In this case, information communication between the monitoring server 20 and the monitor terminal 30 may be performed via the intranet 100, or a public line network such as the Internet connected separately, or mobile communication such as a mobile phone connected to the monitor terminal 30. In the case of a terminal, the configuration may be performed via a communication base station of a connection service provider such as a mobile phone company.

  In addition, the processing device 202 of the monitoring server 20 newly permits a network connection by input from an input unit such as a keyboard or a mouse provided in the monitoring server 20 or from a user terminal having administrator authority connected to the intranet 100. The MAC address of the terminal is registered in the DB 202, or information already registered in the DB 202 is changed or deleted. The above-described operation of the processing device 202 of the monitoring server 20 can be realized by developing a monitoring program stored in the storage area of the monitoring server 20 in the memory of the monitoring server and executing it by the CPU.

  The monitor terminal 30 is an information communication terminal such as a personal computer, a mobile phone, or a PDA used by a security officer of a company or school, and receives position information from an unauthorized connection terminal (user terminal 10) or the monitoring server 20. Have a function of displaying on the screen. This monitor terminal 30 includes facility map image data of a company or school to which the system of the present application is applied, and when the position information is received, the position of the unauthorized connection terminal can be displayed on the map screen and displayed on the screen. Desirable (see FIG. 6). However, the notification of the position information to the supervisor terminal 30 is not limited to this example. For example, a configuration in which text data or voice data such as “XX floor of XX building, No. △ Δ room” is transmitted may be used. Good. Further, as described above, the monitor terminal 30 may be connected to the monitoring server 20 via the intranet 100, or may be configured to receive position information via the external Internet or the like. As described above, when an unauthorized connection terminal is detected by the monitoring server 20, the position information is notified to the monitor terminal 30, so that the security officer goes there and gives a warning / warning to the user of the unauthorized connection terminal. Can do.

  FIG. 4 is a flowchart for explaining the operation of the computer monitoring system. The process of the user device 10 is shown on the right side of the page, the process of the monitoring server 20 is shown in the center, and the process of the monitor terminal 30 is shown on the left side. As a premise of this embodiment, the MAC address of each user terminal 10 permitted to connect to the intranet 100 is registered in the MAC address DB 202 of the monitoring server 20 under the management of a facility such as a company or school. Shall.

  In this situation, when the user terminal 10 that is not permitted to connect, that is, whose MAC address is not registered in the MAC address DB 202 attempts an unauthorized connection to the intranet 100 (step A11), the monitoring server 20 transmits a packet on the network 100. The MAC address of the user terminal 10 is acquired (step A12). Next, the monitoring server 20 confirms whether or not the MAC address acquired by referring to the MAC address DB 202 is registered, and determines that the unauthorized connection is made when the DB 202 does not have the MAC address of the user terminal 10 (step A13). ). If the MAC address is registered in the DB 202, it is determined that the terminal is permitted to connect, and the process ends.

  When the unauthorized connection is detected, the monitoring server 20 requests the user terminal 10 to transmit the position information to the monitor terminal 30 (step A14). The user terminal 10 receives this instruction, acquires the position information derived by the GPS signal receiving means 103, and transmits it to the supervisor terminal 30 (step A16). The monitor terminal 30 receives this position information (step A17) and displays it on the monitor screen (step A18), whereby the security officer heads to the site and gives a warning or warning to the user of the unauthorized connection terminal.

  Thereafter, the monitoring server 20 requests the user terminal 10 involved in unauthorized connection to stop the network connection function (step A19). Upon receiving this request, the connection means 101 of the user terminal 10 stops the network connection function (steps A20 to A21). Thereby, access from the user terminal 10 to important data on the network 100 can be quickly blocked, and damage can be minimized.

  FIG. 5 is a diagram showing this operation image. After the monitoring server 20 sniffs the packet of the network 100 to detect an illegally connected terminal and makes a location information transmission request (T1), the network connection function stop request ( A state of performing T2) is shown. FIG. 6 is a diagram showing an example of the screen of the monitor terminal 30 that has received the position information, and shows a visual indication of where the unauthorized connection terminal is located in the company or school facility. Show.

  Although one embodiment of the present invention has been described in detail, the present invention is not limited to the above embodiment, and can be realized as various other embodiments. For example, in the above-described embodiment, the user terminal 10 has a GPS reception function and derives position information. However, the user terminal 10 may be manually input using an input means such as a keyboard or a mouse. Alternatively, a location information transmitter may be provided for each floor or each room of the building constituting the facility, and the user terminal 10 may receive the information from the transmitter and acquire the location information of the terminal itself. In the case of GPS, the accuracy of indoors and the number of floors of a building may be low. However, by providing means that can acquire accurate position information at appropriate locations indoors, it is possible to acquire accurate position information. Unauthorized connection terminals can be quickly discovered. Further, the MAC address DB 202 does not need to be in the monitoring server 20, and may be registered in an external storage device provided separately.

  The present invention detects a computer terminal that is not permitted to connect to a network, displays its position information on the security officer's terminal screen, and stops the network connection function of the terminal. It can be suitably used in the network information processing industry with improved performance.

It is a figure which shows the whole structure of the computer monitoring system of this invention. 2 is a schematic diagram illustrating a configuration of a user terminal 10. FIG. 2 is a schematic diagram illustrating a configuration of a monitoring server 20. FIG. It is a flowchart explaining operation | movement of a computer monitoring system. It is a figure which shows the operation | movement image of a computer monitoring system. It is a figure which shows the example of a screen of the supervisor terminal 30. FIG.

Explanation of symbols

DESCRIPTION OF SYMBOLS 100 Intranet 10 User terminal 101 Connection means 102 Transmission processing means 103 GPS signal receiving means 20 Monitoring server 201 Processing apparatus 202 MAC address DB
30 Monitor terminal

Claims (10)

  In a system for monitoring computers connected to a network, a database in which MAC addresses of computers permitted to be connected to the network are registered in advance, and packets sent on the network are monitored, and MAC addresses included therein are monitored. And a monitoring server that determines that the connection is unauthorized when the password is not registered in the database.   2. The computer monitoring system according to claim 1, comprising one or more computer terminals connected to the network, wherein the monitoring server issues a connection stop request to a computer terminal determined to be an unauthorized connection, and the computer terminal A computer monitoring system comprising network connection means for stopping a network connection function when a stop request is received.   The computer monitoring system according to claim 2, wherein the monitoring server requests the computer terminal determined to be unauthorized connection to transmit position information, and the computer terminal includes means for acquiring position information of the own terminal, A computer monitoring system, which transmits position information acquired upon receiving a request for position information to a designated destination.   4. The computer monitoring system according to claim 3, wherein the position information acquisition unit of the computer terminal includes a GPS signal receiving unit.   5. The computer monitoring system according to claim 3, wherein the system further includes an information communication terminal belonging to a security officer, and the position information of the computer terminal is obtained from the monitoring server or the computer terminal determined to be the unauthorized connection. A computer monitoring system which is transmitted to an information communication terminal of a security officer.   In a system monitoring method for monitoring a computer connected to a network, a monitoring server connected to the network monitors a packet transmitted on the network, and a MAC address of a computer permitted to connect in advance is registered. A step of determining an unauthorized connection when the MAC address included in the packet is not registered in the database, and a step of transmitting a connection stop request to the computer terminal determined to be an unauthorized connection by the monitoring server. A computer monitoring method characterized by the above.   7. The computer monitoring method according to claim 6, further comprising a step in which the monitoring server requests the location information from a computer terminal determined to be an unauthorized connection.   The monitoring method according to claim 6 or 7, wherein a computer terminal connected to the network stops a network connection function when receiving a connection stop request from the monitoring server; Computer monitoring, comprising: acquiring location information; and transmitting the acquired location information to a specified destination when the computer terminal receives a request for location information from the monitoring server. Method.   In a monitoring server program for monitoring a computer connected to a network, the monitoring server monitors a packet transmitted to the network, and the packet is stored in a database in which MAC addresses of computers permitted to be connected in advance are registered. A program for executing a step of determining an unauthorized connection when a MAC address included in the password is not registered and a step of transmitting a connection stop request to a computer determined to be an unauthorized connection. The program according to claim 9, further causing the monitoring server to execute a step of requesting transmission of the position information to a computer determined to be an unauthorized connection.

Images