JP2008084279A - Computer monitoring method and computer program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To monitor whether or not a computer is connected to a network other than the network under control. <P>SOLUTION: A monitoring application 10 to which the computer monitoring method is applied holds a standard value (an IP address of an in-house LAN 3a here) of address information (an IP address here) used in network connection, monitors whether or not the computer is set to the one other than the standard value by elapse of fixed time, when the computer is set to the one different from the standard value, transmits a message indicating that the computer is set to the IP address other than the standard value to a manager server 2 connected to the in-house LAN 3a. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a technique for monitoring a network connection of a computer.

For the purpose of preventing leakage of confidential information (for example, personal information), it is necessary to monitor computers connected to a network. For example, Patent Document 1 discloses a system that checks the validity of a computer by a combination of the IP address and MAC address of the computer connected to the network.
JP 2000-201143 A

  However, if the computer is a notebook computer, the notebook computer may be taken out and used and connected to an external network as well as an internal network. For example, a company notebook computer may be connected not only to an in-house network but also to a wireless network on the go or a commercial network drawn to home.

  In some companies, in order to prevent damage caused by computer viruses, it is increasingly prohibited to reconnect a company computer connected to an external network to the internal network. Although the legitimacy of the computer connected to the in-house network can be verified, it was not possible to monitor whether the computer was connected to the outside network before connecting to the in-house network.

  Therefore, the present invention enables a computer administrator in a company or the like to monitor whether a computer to be managed is connected to a network (for example, an external network) other than a network under management (for example, an internal network). It is an object to provide a computer monitoring method and a computer program installed in the computer.

  A first invention for solving the above-described problem is a computer monitoring method for monitoring a network connection status of a computer, and obtains address information used for network connection from the computer every time a predetermined time elapses. After that, the standard value of the address information is compared with the address information acquired from the computer, and when the address information acquired from the computer is different from the standard value, the address information different from the standard value is set. This is notified from the computer to a predetermined device via a network to which the computer is connected.

  Further, the second invention is the computer monitoring method according to the first invention, wherein when the address information acquired from the computer is different from the standard value, the contents set in the computer are The information is transmitted from the computer to the device via a connected network.

  Furthermore, a third invention is the computer monitoring method according to the first invention, wherein when the address information acquired from the computer is different from the standard value, the computer uses the address information different from the standard value. Is stored as a log, and when the address information is set to the standard value, the log is transmitted to a device managing the computer via a network to which the computer is connected. It is characterized by.

  Furthermore, a fourth invention is the computer monitoring method according to any one of the first to third inventions, wherein the standard value is obtained when the address information obtained from the computer is different from the standard value. A message indicating that the computer has been set to the address information different from the standard value, and a message indicating that the computer has been set to the address information different from the standard value. It is characterized by displaying.

  Furthermore, the fifth aspect of the invention obtains address information used when connecting to a network from the computer every time a predetermined time elapses, and then obtains a standard value of the address information and the address information obtained from the computer. If the address information acquired from the computer is different from the standard value, the address information different from the standard value is set to the computer via the network to which the computer is connected. It is a computer program for making a computer implement | achieve the function to notify to a predetermined apparatus from.

  Further, a sixth invention is the computer program according to the fifth invention, wherein when the address information obtained from the computer is different from the standard value, the computer connects the contents set in the computer. A computer program for causing a computer to realize a function of transmitting from the computer to the apparatus via a network.

  Further, a seventh invention is the computer program according to the fifth invention, wherein when the address information acquired from the computer is different from the standard value, the computer uses the address information different from the standard value. A function of storing the setting as a log, and transmitting the log to a device managing the computer via a network to which the computer is connected when the address information is set to the standard value. It is a computer program for making a computer implement | achieve.

  Further, an eighth invention is the computer monitoring method according to any one of the fifth to seventh inventions, wherein the standard value is obtained when the address information obtained from the computer is different from the standard value. A message indicating that the computer has been set to the address information different from the standard value, and a message indicating that the computer has been set to the address information different from the standard value. It is a computer program for making a computer implement | achieve the function to display.

  According to the invention, it is possible to grasp that the computer is connected to a network other than the one where the standard value is used by comparing the address information acquired from the computer with the standard value.

  The fact that the address information different from the standard value is set may be notified from the computer to the apparatus when the address information different from the standard value is set. The information set in the address information may be stored as the log, and the computer may notify the apparatus when the address information is set to the standard value.

  If the computer administrator can grasp the network connection status of the computer, after connecting to an external network, an action can be taken to prevent reconnection to the in-house network.

  Further, by displaying on the computer that the address information is different from the standard value, the address information is set different from the standard value for not only the administrator of the computer but also the user. And the user complies with a rule not to connect the computer to an external network.

  As described above, according to the invention, a computer monitoring method that allows a computer administrator to check whether a computer to be managed is connected to a network other than a network under management (for example, an in-house network), and A computer program installed on a computer can be provided.

  From here, the computer monitoring method according to the present invention will be described in detail with reference to the drawings. FIG. 1 is a diagram for explaining a system to which a computer monitoring method according to the present invention is applied.

  As shown in FIG. 1, the notebook computer 1 is connected to various networks and used in order to use the Internet 3.

  For example, in an office, the computer 1 is connected to an in-house LAN 3a (Local Area Network), and when away from home, the computer 1 is connected to a wireless network 3b using a wireless modem, and at home, the computer 1 uses ADSL or the like. To the commercial network 3c.

  The computer 1 is installed with a monitoring application 10 which is a computer program for realizing the computer monitoring method according to the present invention.

  The monitoring application 10 holds a standard value (here, the IP address of the in-house LAN 3a) of address information (here, an IP address) used for network connection, and a non-standard value every time a certain time elapses. It is monitored whether the IP address is set, and when the IP address is different from the standard value, a message indicating that the IP address is different from the standard value is sent to the administrator server 2 connected to the in-house LAN 3a. It has a function to send.

  In the example of FIG. 1, when the computer 1 is set to an IP address used in the wireless network 3b or the commercial network 3c, a message indicating that the IP address is set different from the standard value is sent from the computer 1 to the administrator. From this message, the administrator of the computer 1 can know that the computer 1 is set to an IP address different from the standard value.

  If the administrator of the computer 1 can grasp the network connection status of the computer 1, after connecting to an external network (wireless network 3b or commercial network 3c), an action for preventing reconnection to the in-house LAN 3a can be performed. Become.

  From here, the computer monitoring method according to the present invention will also be described while explaining the operation of the monitoring application 10. FIG. 2 is a flowchart showing an operation in which the monitoring application 10 monitors the IP address.

  The monitoring application 10 is a computer program that operates resident in the computer 1. When the computer 1 is started up, the monitoring application 10 is also started up, and the operation shown in FIG. The IP address set in is monitored.

  The interval for monitoring the IP address set in the computer 1 may be about 1 minute, but it is preferable that the monitoring application 10 has a function for changing this interval.

  Step S1 in FIG. 2 is a step in which the monitoring application 10 acquires an IP address set in the computer 1. In this step, the monitoring application 10 acquires the IP address set for the computer 1 at this time from the registry of the computer 1.

  Step S <b> 2 is a step in which the monitoring application 10 confirms the IP address set in the computer 1. In this step, the monitoring application 10 compares the IP address acquired from the registry of the computer 1 with the standard value held by the monitoring application 10.

  The operation after step S2 is branched depending on the state of the computer, and when the IP address acquired in step S1 is the same as the standard value, the flow of FIG. 2 ends. If the IP address acquired in step S1 is different from the standard value, the process proceeds to step S3.

  Step S3 is a step of confirming whether the IP address acquired in step S1 is the same IP address as when the previous message was transmitted. In this step, if the IP address is the same as the previous one, this operation ends. If the IP address is different from the previous one, the process proceeds to step S4.

  In step S3, the above-described message is checked only if the IP address acquired in step S1 is the same IP address as when the previous message was transmitted, when the IP address of the computer 1 is set to a value other than the standard value. Is transmitted to the administrator server 2.

  In order to execute this step, when the monitoring application 10 transmits a message to the administrator server 2, the monitoring application 10 holds the IP address set in the computer in the memory.

  Step S <b> 4 is a step in which the monitoring application 10 transmits a message indicating that the computer 1 is set to an IP address other than the standard value to the administrator server 2. As described above, when the monitoring application 10 transmits a message to the administrator server 2, the monitoring application 10 holds the IP address set in the computer 1 in the memory.

  In this step, the monitoring application 10 uses a standard value of the IP address, the host name of the computer, and the like using e-mail, ICMP, or the like via a connected network (here, the wireless network 3b or the commercial network 3c). A message describing the login name of the user who has logged into the computer is transmitted to the administrator server 2, and the flow in FIG. 2 ends.

  In step S4, when the computer 1 is set to an IP address different from the standard value, a message is transmitted to the administrator server 2, and the computer 1 is set to an IP address different from the standard value. The message may be displayed on the screen of one computer.

  By displaying on the screen of the computer 1 that the IP address is different from the standard value, not only the administrator of the computer 1 but also the user can be notified that the IP address is different from the standard value. The user complies with a rule not to connect the computer 1 to an external network (in this case, the wireless network 3a or the commercial network 3b).

(Modification)
In the embodiment described above, the monitoring application 10 transmits a message to the administrator server 2 when an IP address different from the standard value is set in the computer 1, but an IP address different from the standard value is set. This may be stored as a log, and this log may be transmitted to the administrator server 2 when the computer 1 is set to a standard IP address.

  FIG. 3 is a flowchart showing the operation of the monitoring application 10 when storing as a log that an IP address different from the standard value has been set.

  Step S10 in FIG. 3 is a step in which the monitoring application 10 acquires an IP address set in the computer 1. In this step, the monitoring application 10 acquires the IP address set for the computer 1 at this time from the registry of the computer 1.

  Since the IP address acquired in this step is used when monitoring the IP address next time, the monitoring application 10 holds the IP address acquired in this step in a memory or the like.

  Step S <b> 11 is a step in which the monitoring application 10 confirms the IP address set in the computer 1. In this step, the monitoring application 10 compares the IP address acquired from the registry of the computer 1 with the standard value held by the monitoring application 10.

  The operations after step S11 are branched depending on the state of the computer 1. If the IP address acquired in step S10 is the same as the standard value, the process proceeds to step S14. If the IP address acquired in step S1 is different from the standard value, step S12 is performed. Proceed to

  Step S12 is a step of confirming whether the IP address acquired in step S1 is the same IP address as when the previous message was transmitted. In this step, if the IP address is the same as the previous time, the flow of FIG.

  In step 12, the log is stored only when the IP address of the computer 1 is set to a value other than the standard value to check whether the IP address acquired in step S10 is the same IP address as when the previous message was transmitted. It is to do.

  In order to execute this step, the monitoring application 10 holds the IP address set in the computer in the memory when storing the log.

  Step S13 is a step of storing a log indicating that the computer 1 has been set to an IP address other than the standard value. As described above, when the monitoring application 10 stores the log, the monitoring application 10 holds the IP address set in the computer 1 in the memory.

  At this step, the monitoring application 10 stores information such as the date and time when this step was executed, the standard value of the IP address, the host name of the computer 1 and the login name of the user who logged in to the computer 1 as a log. The flow of 3 ends.

  In step S13, when the computer 1 is set to an IP address different from the standard value, a message is transmitted to the administrator server 2, and the computer 1 is set to an IP address different from the standard value. The message may be displayed on the screen of one computer.

  Step S14 executed when the IP address is the same as the standard value is a step for confirming whether there is an unsent log. In this step, if there is an unsent log, the monitoring application 10 proceeds to step S15. If there is no unsent log, the flow in FIG. 3 ends.

  In step S15 executed when there is an unsent log, the unsent log is sent to the administrator server 2 via the connected network (in this case, the in-house LAN 3a), and the sent information is stored in the log. After the assignment, the flow in FIG. 3 ends.

The figure explaining the system to which the computer monitoring method was applied. The flowchart which showed the operation | movement which the monitoring application monitors an IP address. The flowchart which showed operation | movement of the monitoring application when memorize | storing as a log.

Explanation of symbols

1 Computer 10 Monitoring application 3a Internal LAN
3b Wireless network 3c Commercial network

Claims (8)

  A computer monitoring method for monitoring a network connection status of a computer, wherein after a predetermined time elapses, address information used for network connection is acquired from the computer, and then a standard value of the address information and the computer The address information acquired from the computer is compared, and if the address information acquired from the computer is different from the standard value, the computer is connected that the address information is set different from the standard value. A computer monitoring method comprising: notifying a predetermined device from the computer via a network.   The computer monitoring method according to claim 1, wherein when the address information acquired from the computer is different from the standard value, the content set in the computer is transmitted via a network to which the computer is connected. A computer monitoring method comprising: transmitting from the computer to the device.   2. The computer monitoring method according to claim 1, wherein when the address information acquired from the computer is different from the standard value, it is stored as a log that the computer is set in the address information different from the standard value. Then, when the address information is set to the standard value, the log is transmitted to a device managing the computer via a network to which the computer is connected.   4. The computer monitoring method according to claim 1, wherein when the address information acquired from the computer is different from the standard value, the computer uses the address information different from the standard value. A computer monitoring method characterized by notifying the management device of the computer of the setting and displaying a message on the computer indicating that the computer has been set in the address information different from the standard value. .   Every time a certain time has elapsed, after obtaining from the computer address information used when connecting to the network, the standard value of the address information is compared with the address information obtained from the computer, and obtained from the computer. If the address information is different from the standard value, a function for notifying the predetermined information from the computer via the network to which the computer is connected is set to the address information different from the standard value. A computer program for realizing a computer.   6. The computer program according to claim 5, wherein when the address information acquired from the computer is different from the standard value, the content set in the computer is transmitted via the network to which the computer is connected. A computer program for causing a computer to realize a function of transmitting from the computer to the device.   6. The computer program according to claim 5, wherein when the address information acquired from the computer is different from the standard value, it is stored as a log that the computer is set to the address information different from the standard value. A computer program for causing a computer to realize the function of transmitting the log to a device managing the computer via a network to which the computer is connected when the address information is set to the standard value. 8. The computer monitoring method according to claim 5, wherein when the address information acquired from the computer is different from the standard value, the computer uses the address information different from the standard value. Notifying the management device of the computer that the setting has been made, and causing the computer to realize a function of displaying on the computer a message indicating that the computer has been set in the address information different from the standard value Computer program.

Images