JP2007018044A - Self-reorganization system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a self-reorganization system equipped with a means for enabling the other computer which has not been hacked in the case of illegal hacking to reconfigure a system for maintaining the minimum task while holding the consistency of data, and to avoid any abnormal circumstance where all tasks are put in a stop status. <P>SOLUTION: This self-reorganization system is configured of a plurality of computers including a hacking detecting means 10 to which databases 101 to 104 where basic data are stored, and respectively accessed are assigned for monitoring the abnormal status of hacking, a configuration table 11 for storing path configuration and execution process list corresponding to the abnormal status due to illegal hacking, a communication module 12 for receiving status change notification from the other computer, and for notifying the other computer of the status change, and for receiving the notification of hacking from the other computer and an execution file group 13 such as task software and software for facilitating countermeasures to hacking, wherein the computer which has been hacked changes its own path configuration, and notifies the other computer of the abnormal status, and the other computer reconfigures a defense system. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a self-reorganization system, and more particularly, to a means for autonomous defense when any of a plurality of computers constituting the system receives an unauthorized intrusion.

  Conventional unauthorized intrusion prevention systems are overwhelmingly dedicated to single functions that block intrusions against unauthorized intrusions.

  On the other hand, as a system to maintain data consistency even when there is a failure, each computer has a common shared memory externally, and each computer monitors its own abnormality and is assigned to that computer. The status monitoring means for writing the processing status information related to the corresponding job to the storage means of the allocated resource, and the status storage section, while the information on the status of the business and the occurrence of the failure are written in the status storage section in the shared memory When it detects that another computer is down due to a failure, it incorporates a resource incorporation means for incorporating business-related resources allocated based on the definition information of the table under its own management, and incorporating under management when the other computer is down Recovery processing means for accessing a resource storage means using a processing task and constructing a state in which a corresponding job can be executed based on the information stored in the storage means , Computer backup system that includes a processing executing means for executing the executable-constructed business has been proposed by the business and recovery processing means according to the assignment from the beginning (for example, see Patent Document 1).

Japanese Patent Application Laid-Open No. 07-044413 (page 3, FIGS. 1 and 2)

  In the conventional intrusion prevention system, if at least one computer is illegally intruded, the business may be interrupted, and it is possible to prevent deeper illegal intrusion from an illegally intruded computer to another computer. It was difficult.

  Further, the computer backup system described in Patent Document 1 mainly has a problem of backup against a system down, and cannot cope with unauthorized intrusion.

  In the end, there was a problem that the reconfigured system could not perform the backup function unless the consistency of not only the executable file (program) group but also the basic data was maintained.

  The object of the present invention is to restructure the system defense system so that other computers that have not been intruded can maintain the minimum operations while maintaining the consistency of data when an unauthorized intrusion occurs. It is to provide a self-reorganization system provided with means for avoiding an abnormal situation that becomes a stop state.

  In order to solve the above-described problems, the present invention provides an unauthorized intrusion detection means for monitoring an abnormal state of unauthorized intrusion, which is assigned with a database storing basic data and accessed by each database, and a path configuration corresponding to the abnormal state due to unauthorized intrusion A configuration table that holds an execution process list, a communication module that receives state change notifications from other computers, notifies state changes to other computers, and receives unauthorized intrusion notifications from other computers, and business software And a computer that includes an executable file group such as unauthorized intrusion prevention software, and the unauthorized computer changes its route configuration and notifies other computers of the abnormal state or changed route configuration, The remaining computers that received the notification check the path configuration and execution program by checking the path configuration against the abnormal status or changed path configuration table. Change the scan, we propose a self re-organization system to rebuild the defense system in a coordinated manner.

  According to the present invention, when an unauthorized intrusion is detected, another computer that has not been illegally intruded reconstructs the system so as to prevent unauthorized intrusion deeper than that, so damage can be limited to a minimum.

  In addition, instead of the conventional centralized management method using a single shared table, each computer holds a configuration table and operates flexibly in cooperation with an abnormal situation, so even if the configuration table of an unauthorized computer is destroyed It is possible to reconstruct the system defense system so that other computers that have not been hacked can maintain the minimum operations while maintaining the consistency of the data, so that the abnormal situation in which all operations are stopped can be avoided.

  In addition, when one computer is hacked and another computer enters the defense system, and another computer is hacked, each computer checks the abnormal state against the configuration table and creates a new anomaly. The defense system corresponding to the state can be reconstructed.

  Next, an embodiment of the self-reorganization system according to the present invention will be described with reference to FIGS.

  FIG. 1 is a block diagram showing a system configuration of embodiment 1 of a self-reorganization system according to the present invention.

  The self-reorganization system according to the first embodiment includes computers 101 to 104 interconnected by a network 105. The computer 101 monitors unauthorized intrusion into the computers 102 to 104, and the computers 102 to 104 are processing their respective tasks. Computers 101-104 are assigned databases D101-D104 which store basic data and access each.

  Each of the computers 101 to 104 includes a detection means 10, a configuration table 11, a communication module 12, and an execution file group 13 such as business software and unauthorized intrusion countermeasure software.

  The detection means 10 monitors the abnormal state of unauthorized intrusion. The configuration table 11 holds path configuration information and an execution process list corresponding to an abnormal state due to unauthorized intrusion.

  The communication module 12 receives state change notifications from other computers, notifies state changes to other computers, and receives unauthorized intrusion notifications from other computers. The executable file group 13 stores all the software listed in the process list held in the configuration table 11.

  FIG. 2 is a diagram showing an example of the configuration table 11 used in the self-reorganization system of the present invention.

  The configuration table 11 is created so that an ID, an abnormal state, route configuration information, and an execution process list become one record, and each record has an optimum route configuration information and an execution process list corresponding to each abnormal state. Is assigned. Therefore, when notifying the configuration information to other computers, it is only necessary to transmit the ID, and it is not necessary to transmit all the records of the configuration table 11.

  When any one of the computers 101 to 104 is illegally intruded, the detection means 10 is used to detect an unauthorized intrusion into the own computer, or an unauthorized intrusion is detected from the computer 101 monitoring the unauthorized intrusion to the entire computer. You will be notified.

  The computer that has detected an unauthorized intrusion or that has been notified of an unauthorized intrusion collates the detected information or the notified information with the configuration table 11 in FIG. 2, and extracts path configuration information and an execution process list from the corresponding abnormal state. .

  The computer that has received the unauthorized intrusion changes the route information of the computer based on the route configuration information, and activates the corresponding executable file from the executable file group 13 based on the execution process list.

  If the business process started before receiving the notification is not in the execution process list, the business process is terminated.

  Upon completion of these processes, the computer that has received unauthorized intrusion transmits the ID of the configuration table 11 that has been changed to another computer related to the system configuration.

  FIG. 3 is a flowchart showing a processing procedure of unauthorized intrusion monitoring of the self-reorganization system according to the present invention.

  Step 61: Each of the computers 101 to 104 is in a reception waiting state, and when there is a notification of unauthorized intrusion detection or configuration change from another computer, it receives the signal.

  Step 62: Since the information received in step 61 is encrypted, the code is decrypted.

  Step 63: It is determined whether or not the decrypted information indicates an abnormal state due to unauthorized intrusion or an ID indicating that the system configuration has been changed based on the configuration table 11 of another computer.

  Step 64a: When it is a notification of an abnormal state due to unauthorized intrusion, the notified information is compared with the abnormal state of the configuration table 11, and the matched record ID, path configuration information, and execution process list are extracted. The configuration table 11 also includes a record in the case of not matching all information, and in this case, the process proceeds to a predetermined process so as not to cause a trouble.

  Step 65a: The route information of the computer is changed based on the route configuration information. The changed route information is referred to by the business operating on the computer and the unauthorized intrusion prevention process.

  Step 66a: Based on the execution process list, the process is changed. Processes that are not in the execution process list and are already running are stopped and terminated.

  Step 67a: When the above processing is completed, the ID of the record matched with the other related computer is notified.

  After notification, it returns to the reception waiting state.

  Step 64b: When notified by ID that the processing has been changed by changing the configuration table 11 of another computer, the notified information is compared with the ID of the configuration table 11, and the matched path configuration information and execution process list are compared. Take out.

  The configuration table 11 also includes a record in the case of not matching all information, and in this case, the process proceeds to a predetermined process so as not to cause a trouble.

  Step 65b: The route information of the computer is changed based on the route configuration information. The changed route information is referred to by the business operating on the computer and the unauthorized intrusion prevention process.

  Step 66b: Change to the corresponding process based on the execution process list. Processes that are not in the execution process list and are already running are stopped and terminated.

Step 67b: When the above processing is completed, the ID is notified to other related computers.
After notification, it returns to the reception waiting state.

  In Steps 64a and 64b, in addition to a single matching method between the received information and the configuration table 11, when IDX1 is acquired and another IDX2 or abnormal state is acquired, IDX2 includes IDX1. Executes IDX2 processing, if IDX1 includes IDX2, does not execute IDX2 processing, and if IDX1 does not include or partially includes IDX2, includes both states A complex matching method such as searching for an abnormal state and executing a matched process may be employed.

  FIG. 4 is a block diagram showing a system configuration of Embodiment 2 of the self-reorganization system according to the present invention.

  The self-reorganization system according to the second embodiment includes a gateway computer 201 that relays between an external network 205 and an internal network 206, a domain server computer 202 that can be referred to by the computers 201 to 204, and a database access computer to a database D203. 203 and a service reception computer 204 from clients of the internal network 206 and the external network 205. Each of the computers 201 to 204 has unauthorized intrusion detection means.

  For example, it is assumed that the domain server computer 202 detects unauthorized intrusion into the database access computer 203. The domain server computer 202 activates the packet monitoring software based on the configuration table 11. In addition, the request from the client to the database access computer 203 changes the route to be transferred to the service receiving computer 204, and in order to prevent deeper unauthorized intrusion, the access from the unauthorized database access computer 203 To refuse.

  After the change is completed, the database access computer 203 notifies the other related gateway computer 201 and the service reception computer 204 of the changed ID of the configuration table 11.

  Upon receiving the ID notification, the gateway computer 201 compares the configuration table 11 with the notified ID, and stops all services based on the corresponding execution process list.

  On the other hand, the service reception computer 204 that has received the notification of the ID collates the configuration table 11 with the notified ID, and accesses the database D203 along with the service reception system from the client based on the corresponding execution process list. Start the system. Furthermore, in order to prevent deeper illegal intrusion, software for blocking access to the database D203 from the database access computer 203 is activated.

  By this series of processing, the system is changed to the minimum system operation configuration that only accesses the database D203 from the inside, and the service request from the outside is cut off, and the packet monitoring software is started to prevent unauthorized intrusion. Rebuild your defense system.

  FIG. 5 is a block diagram showing a system configuration of Embodiment 3 of the self-reorganization system according to the present invention.

  The third embodiment includes a mail server computer 303, a file server computer 304, a client computer 301 that uses services of the mail server computer 303 and the file server computer 304, and a management system computer 302 that are interconnected by a network 305. Become. Each of the computers 301 to 304 has unauthorized intrusion detection means.

  For example, the mail server computer 303 detects unauthorized access to the mail server computer 303 from a client computer 301 that is infected with an unknown computer virus and is in an abnormal state. When the mail server computer 303 determines that the client computer 301 has been illegally intruded, the mail server computer 303 compares the abnormal state with the configuration table 11, deletes the route information from the client computer 301 based on the matched configuration information, and executes A process for refusing access from the client computer 301 based on the process list is started.

  The mail server computer 303 transmits the ID of the configuration information to another related management system computer 302.

  The management system computer 302 that has received the ID of the configuration information collates the ID with the configuration table 11, and based on the matched configuration information, the packet monitoring software in the execution process list and the software that disables communication between the client computer 301 Start the software.

  Thereafter, the mail server computer 303 transmits the ID of the configuration information to the file server computer 304 that is related to system operation.

  The file server computer 304 that has received the ID of the configuration information collates the ID with the configuration table 11, stops the existing file system service based on the matched configuration information, and excludes the client computer 301 from the file sharing service process. Start up.

  For detection of unauthorized intrusion, an unauthorized intrusion prediction detection system is built in the computer. The unauthorized intrusion detection and detection system, in addition to the process of normal business processing, for the invocation of input / output data, load and interface, for example, the behavior that is assumed to be abnormal by pattern matching using a neural network, etc. Detect as abnormal.

  A computer for detecting unauthorized intrusion is arranged separately, and when there is a sign of unauthorized intrusion, the computer is identified and abnormal information is notified to other related computers.

  In the configuration table 11, the path and process execution list correspond to each abnormal state. The system newly reconstructed for the abnormal state does not use the same version, the same application, and the same device driver of the same operating system as the computer in the abnormal state.

  In any embodiment, a computer that has been illegally intruded is provided with means for shutting down its own computer based on the configuration table when an abnormal state is detected.

It is a block diagram which shows the system | strain structure of Example 1 of the self-reorganization system by this invention. It is a figure which shows an example of the structure table used with the self-reorganization system of this invention. It is a flowchart which shows the process sequence of the unauthorized intrusion monitoring of the self-reorganization system by this invention. It is a block diagram which shows the system | strain structure of Example 2 of the self-reorganization system by this invention. It is a block diagram which shows the system | strain structure of Example 3 of the self-reorganization system by this invention.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 Detection means 11 Configuration table 12 Communication module 13 Executable file group 101-104 Computer 201 Gateway computer 202 Domain server computer 203 Database access computer 204 Service reception computer 205,206 Network 301 Client computer 302 Management system computer 303 Mail server computer 304 File server Computer 305 Network D101-D104 Database D203 Database

Claims (7)

  An intrusion detection means that stores basic data and is accessed by each database and monitors abnormal states of unauthorized intrusion, a configuration table that holds a path configuration and execution process list corresponding to abnormal states due to unauthorized intrusion, and others A communication module that receives status change notifications from other computers, notifies status changes to other computers and receives unauthorized intrusion notifications from other computers, and executable files such as business software and unauthorized intrusion prevention software A self-reorganization system characterized in that a computer that has been illegally intruded changes a path configuration of itself and notifies other computers of an abnormal state. An intrusion detection means that stores basic data and is accessed by each database and monitors abnormal states of unauthorized intrusion, a configuration table that holds a path configuration and execution process list corresponding to abnormal states due to unauthorized intrusion, and others A communication module that receives status change notifications from other computers, notifies status changes to other computers and receives unauthorized intrusion notifications from other computers, and executable files such as business software and unauthorized intrusion prevention software A plurality of computers including the computers, and the plurality of computers are separately arranged to detect unauthorized intrusion into the plurality of computers,
The separately arranged computer identifies the intrusion target computer when there is a sign of unauthorized intrusion, notifies the related other computer of the abnormal information, and / or the illegally intruded computer has its own path configuration. A self-reorganization system characterized by changing the system and notifying other computers of abnormal conditions. In the self-reorganization system according to claim 1 or 2,
A self-reorganization system in which the remaining computers that receive the notification collate the abnormal state with the configuration table, change the path configuration and execution process, and reconstruct the defense system in cooperation.   An intrusion detection means that stores basic data and is accessed by each database and monitors abnormal states of unauthorized intrusion, a configuration table that holds a path configuration and execution process list corresponding to abnormal states due to unauthorized intrusion, and others A communication module that receives status change notifications from other computers, notifies status changes to other computers and receives unauthorized intrusion notifications from other computers, and executable files such as business software and unauthorized intrusion prevention software A self-reorganization system in which a computer that has been illegally intruded changes a route configuration of the computer and notifies other computers of the changed route configuration. The self-reorganization system according to claim 4,
The remaining computers that have received the notification check the path configuration against the configuration table, change the path configuration and execution process,
A self-reorganization system characterized by collaborative reconstruction of the defense system. In the self-reorganization system according to any one of claims 1 to 5,
The configuration table includes an ID uniquely assigned to a combination of an abnormal state, a path configuration, and an execution process list,
The self-reorganization system is characterized in that the notification of the abnormal state or the changed route configuration is made by transmitting / receiving only the ID. In the self-reorganization system according to any one of claims 1 to 6,
A self-reorganization system characterized in that a computer that has been illegally intruded is provided with means for shutting down its own computer based on a configuration table when an abnormal state is detected.

Images