JP2011221639A - Communication management device, communication management method and communication management program for network - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a communication management device for network capable of preventing a damage from spreading such as leak or tampering of information on email when accessed by a person other than the intended recipient.SOLUTION: If a personal computer device 50 has made an unauthorized access to a mail server computer device 60, a communication management device 10 identifies the personal computer device 50 which performed the unauthorized access and the mail server computer device 60 to which the communication was made based on communication record of a security monitoring device 30, and also identifies a port 41 of a network switching device 40 connected with the mail server computer device 60 to which the unauthorized access was made. The communication management device 10 then blocks connection and communication between the mail server computer device 60 and a TCP/IP network 20 by disabling the identified port 41.

Description

  The present invention relates to network communication management, and more particularly, to a network communication management apparatus, a communication management method, and a communication management program for preventing an increase in damage caused by leakage or falsification of electronic mail information.

  In a conventional mail server device, when a user of a client device downloads an e-mail delivered to the user from the mail server, the user is authenticated by authenticating the user with the use ID and password of the mail server. The content of the mail was prevented from being stolen by a third party other than the mail recipient. However, there are cases where a third party accesses the mail server device by unauthorized means, and in that case, not only the text of the e-mail but also the file attached thereto may be stolen. In addition, there is a possibility that the e-mail itself may be deleted together with the attached file.

  In order to solve such problems, an email filter is installed in front of the destination mail server used by the recipient of the email, and the file attached to the email is separated and stored in the file server. An e-mail filter device has been proposed (Patent Document 1). With this configuration, even if a third party other than the original e-mail recipient accesses the destination mail server by unauthorized means, the file attached to the e-mail is stolen or deleted by the third party. Can be prevented.

  Also, conventionally, when communication is performed by unauthorized means to a computer device of a server that provides services such as e-mail, notification from a security monitoring device such as a firewall, or the user of the device that received the service By knowing the execution of unauthorized communications through notifications from the Internet and stopping services such as e-mails, the spread of damage on the network was prevented. However, with this method, it is difficult to prevent information leakage or expansion of tampering after the contents of the e-mail have been altered or after the contents have been stolen to know that unauthorized communication has been performed. Met. In addition, computer devices of other servers connected to the same network switch or the like are searched, and unauthorized communication is executed in the same manner, which may cause damage to the network.

  Therefore, as a means to block unauthorized communication, collect unauthorized communication records, identify the communication device that performed unauthorized communication based on the collected record information, and connect the communication device based on the information of the identified communication device Identify the communication relay device and connection port that are connected, and rewrite the connection port usage status information from "Connected" to "Disconnect" to disable communication using the connection port. A communication management device that is blocked has been proposed (Patent Document 2).

  In addition, in order to identify a genuine user (user himself / herself), a unique URL including a service code, a user's mail address, and a character string generated using a function based on the mail address is generated. If a character string is regenerated by using a function based on the unique URL sent from the receiving client, the character string in the unique URL is collated, and if it matches the registered character string, A technique for determining that the user is a genuine user has been proposed (Patent Document 3).

JP 2007-251554 A JP 2006-332997 A JP 2004-086236 A

  However, with the technique disclosed in Patent Document 1, a third party other than the original e-mail recipient can also access the file server, and the file attached to the e-mail is stolen by this third party. Or, there was a risk of being erased.

  In addition, although the technique disclosed in Patent Document 2 and the technique disclosed in Patent Document 3 can identify and block a communication device that performs unauthorized communication, another connection port in the same network may be used. Since re-communication can be attempted, unauthorized communication to the server computer device that provides services such as e-mail cannot be blocked at the physical level.

[Object of invention]
Therefore, the present invention has been made in view of such circumstances, and increases the leakage of e-mail information or the damage caused by tampering when accessed by a third party other than the true recipient of the e-mail. An object of the present invention is to provide a network communication management apparatus, a communication management method, and a communication management program that can be prevented.

In order to solve the above problems, a network communication management device according to the present invention includes a personal computer device that performs communication via a network, a server computer device that responds to communication corresponding thereto, the server computer device, and the network. A network switch device functioning as a connection interface of the server computer device, and a network communication management device connected via a network to each of a security monitoring device that monitors network communication,
A personal computer that collects communication records of the security monitoring device, determines whether or not unauthorized communication has been executed based on the communication records, and executes unauthorized communication when it is determined that unauthorized communication has been executed Communication record collection specifying means for specifying the device and the server computer device that responded to the unauthorized communication;
A network switch device connection cut-off control means for changing the network switch device to which the identified server computer device is connected from the usable state to the unusable state and controlling the connection with the network;
It is characterized by comprising.

In order to solve the above problems, a network communication management method according to the present invention includes a personal computer device that performs communication via a network, a server computer device that responds to communication corresponding thereto, and the server computer device. There is a network switch device that is connected to the network and functions as a connection interface of the server computer device, and a network communication management device that is connected to the security monitoring device that monitors network communication via the network. And
Collect communication records of the security monitoring device, determine whether unauthorized communication has been executed based on the collected communication records, and execute the unauthorized communication when it is determined that unauthorized communication has been executed Identifying the personal computer device and the server computer device that responded to the unauthorized communication, the collection, determination, and specific processing operations are executed by the communication record collection specifying means,
The network switch device connection cut-off control means changes the network switch device to which the specified server computer device is connected from the usable state to the unusable state, thereby controlling the connection with the network. It is what.

In order to solve the above problems, a network communication management program according to the present invention includes a personal computer device that performs communication via a network, a server computer device that responds to communication corresponding thereto, and the server computer device. There is a network switch device that is connected to the network and functions as a connection interface of the server computer device, and a network communication management device that is connected to the security monitoring device that monitors network communication via the network. And
A communication record collection determination function for collecting communication records of the security monitoring device and determining whether unauthorized communication has been executed based on the collected communication records;
A device specifying function for specifying a personal computer device that has executed the unauthorized communication and a server computer device that has responded to the unauthorized communication when it is determined that the unauthorized communication has been executed;
And a network switch device connection cut-off control function for changing the network switch device to which the specified server computer device is connected from the usable state to the unusable state to cut off the connection with the network,
These functions are implemented by a computer.

  According to the present invention, the communication management device blocks communication between the server computer device and the network by changing the network switch device connected to the server computer device that has been illegally accessed to an unusable state. Therefore, even if unauthorized access is attempted again, it is not possible to connect to the server computer device, and leakage of electronic mail information or expansion of tampering can be prevented.

It is a block diagram which shows 1st Embodiment of the communication management apparatus for networks which concerns on this invention. It is a figure which shows an example of the information recorded on the apparatus connection information table. It is a figure which shows an example of the information recorded on the apparatus information table. It is a figure which shows an example of the information recorded on the mail recipient information table. It is a figure which shows an example of the information recorded on the communication recording part. It is a figure which shows an example of the information recorded on the switch apparatus address resolution table. It is a figure which shows an example of a communication rule. It is a flowchart which shows the collection step of a communication record collection specific | specification means. It is a flowchart which shows the search step of an apparatus search means. It is a flowchart which shows the search step of an apparatus search means. It is a flowchart which shows the connection cutoff step of a network switch apparatus connection cutoff control means. It is a flowchart which shows the connection recovery step of a network switch apparatus connection recovery control means. It is a block diagram which shows 2nd Embodiment of the communication management apparatus for networks which concerns on this invention. It is a figure which shows an example of the information recorded on the apparatus connection information table. It is a figure which shows an example of the information recorded on the apparatus information table. It is a figure which shows an example of the information recorded on the switch apparatus address resolution table. It is a figure which shows an example of the information recorded on the switch apparatus address resolution table. It is a flowchart which shows the search step of an apparatus search means. It is a flowchart which shows the search step of an apparatus search means. It is a flowchart which shows the search step of an apparatus search means. It is a flowchart which shows the search step of an apparatus search means. It is a flowchart which shows the connection cutoff step of a network switch apparatus connection cutoff control means.

[First Embodiment]
Hereinafter, a first embodiment of a network communication management apparatus according to the present invention will be described with reference to the accompanying drawings.
A network communication management apparatus 1 shown in FIG. 1 includes a communication management apparatus 10 that manages communication of the system, a security monitoring apparatus 30 that monitors communication in a TCP / IP (Transmission Control Protocol / Internet Protocol) network 20, and A network switch device 40 having a device connection interface function, a mail server computer device 60 and a file server computer device 70 which are devices for communicating with other devices and providing services, and for communicating with other devices. The personal computer device 50, which is a device, and a TCP / IP network 20 that connects these devices are configured.

  First, the communication management device 10 includes a device connection configuration management unit 11 that manages connection information between devices, a communication record collection specifying unit 12 that collects communication records, a device search unit 13 that specifies a network switch device, and a network. Network switch device connection cut-off control means 14 for cutting off communication at the switch device, network switch device connection restoration control means 15 for restoring communication, device connection information table 16, device information table 17, and mail recipient as information It includes an information table 18 and is connected to the TCP / IP network 20.

  The device connection configuration management means 11 of the communication management device 10 is a connection between devices of the TCP / IP network 20, the security monitoring device 30, the network switch device 40, the mail server computer device 60, and the file server computer device 70. Information is managed. Connection information between devices is stored in the device connection information table 16.

  The communication record collection specifying unit 12 collects communication records of the security monitoring device 30 managed by the device connection configuration management unit 11 and specifies a device that has executed unauthorized communication and a device that has performed unauthorized communication. Yes.

  The device search means 13 has a function of searching the connection destination network switch device 40 and the ports 41 and 42 based on the IP addresses of the server computer devices 60 and 70. The device search means 13 specifies the network switch device to which the device that has performed unauthorized communication is connected in the device specified by the communication record collection specifying means 12. In addition, the device search means 13 searches the network switch device to which the device that has performed unauthorized communication is connected to determine whether the same type of device as the device that has performed unauthorized communication is connected. If so, identify the device.

  The network switch device connection cut-off control means 14 cuts off the communication in the network switch device 40 to which the device for which unauthorized communication has been executed is connected in the network switch device specified by the device search means 13. The ports 41 and 42 to which the mail server computer device 60 and the file server computer device 70 are connected in the network switch device 40 to which the device that has executed unauthorized communication is connected are changed from usable to unusable. To block communication. This blockage can prevent the occurrence of damage due to further unauthorized communication to the server computer devices 60 and 70 and the spread of damage to the device accessing the service on which the unauthorized communication has been executed.

  The network switch device connection recovery control means 15 changes the ports 41 and 42 of the network switch device 40 from unusable to usable state with respect to the network switch device whose communication is cut off by the network switch device connection cut-off control means 14. , Restore communication.

  As shown in FIG. 2, the device connection information table 16 is a table in which information indicating connection configurations of the network switch devices 40A, 40B, and 40C and the server computer devices 60 and 70 managed by the communication management device 10 is arranged. is there. The device name is recorded in the left column, the port name (16C) used in the right column, the port usage status, the port IP address (16A), the subnet mask (16B), and the device name of the port connection destination (16D), the IP address (16E) of the connection destination device is recorded. In FIG. 1, only the network switch device 40 is connected to the TCP / IP network 20, but a plurality of network switch devices (40B, 40C, 40D, etc.) are also connected.

  Further, as shown in FIG. 3, the device information table 17 is a table in which information indicating the devices and types of the network switch devices 40 and the server computer devices 60 and 70 managed by the communication management device 10 is arranged. The device name to be managed is recorded in the left column, and the device type (17A) and the IP address of the device are recorded in the right column.

  Further, as shown in FIG. 4, the mail recipient information table 18 is a table in which information indicating the correspondence between each personal computer managed by the communication management device 10 and the mail address of the mail recipient is arranged. A mail recipient in the left column is recorded, and a personal computer device used by the mail recipient, an IP address of the device, and an authentication identifier (mail address) of the recipient are recorded on the right side.

  Next, the TCP / IP network 20 implements communication by connecting the communication management device 10, the security monitoring device 30, the network switch device 40, the mail server computer device 60, and the file server computer device 70. It has a function to do.

  As shown in FIG. 1, the security monitoring device 30 has an IP address 31, a communication recording unit 32, and is connected to the TCP / IP network 20. The security monitoring device 30 monitors communication in the TCP / IP network 20 and records the communication content in the communication recording unit 32 when communication is detected. As shown in FIG. 5, the communication record recorded in the communication recording unit 32 includes an IP address (source IP address) of a device that has performed communication and a MAC (Media Access Control) address of the device that has performed communication. (Transmission source MAC address), communication contents, and IP address (transmission destination IP address) of a communication partner apparatus are included.

  As shown in FIG. 1, an IP address 51 and a MAC address 52 are assigned to the personal computer device 50. The personal computer device 50 is a device for communicating with other devices (server computer devices 60, 70, etc.), and is connected to the TCP / IP network 20.

  The network switch device 40 is a device that performs wired communication. As shown in FIG. 1, the network switch device 40 has a port 41 and a port 42, and these functions as a connection interface of the device. The number of ports is not limited to two (ports 41 and 42) in FIG. 1, and may be a form including a plurality of two or more ports. Also, IP addresses 41A and 42A and MAC addresses 41B and 42B are assigned to the ports 41 and 42 of the network switch device 40, respectively.

  Furthermore, the ports 41 and 42 have usage state information 41C and 42C, respectively. The use state information is information indicating whether the ports 41 and 42 are usable or unusable. When the usage status of the ports 41 and 42 is “possible”, communication is possible when each device is connected to the port, and when the usage status is “impossible” Even if each device is connected to a port, communication cannot be performed. The usage state information 41C and 42C can be obtained and updated from devices other than the network switch device 40.

  The network switch device 40 has a switch device address resolution table 48. As shown in FIG. 6, the switch device address resolution table 48 stores a correspondence table between IP addresses (source IP addresses) and MAC addresses (source MAC addresses) included in communication in the network switch device 40. Has been.

  Further, the network switch device 40 has a communication rule 49. As shown in FIG. 7, the communication rule 49 stores a correspondence table between a rule for permitting / denying communication via the network switch device 40 and a MAC address.

  The mail server computer device 60 is a device for communicating with other devices and providing mail information (service) stored in the device 60 to a communication partner device. The mail server computer device 60 is assigned an IP address 61 and a MAC address 62.

  The file server computer device 70 is a device for communicating with other devices and providing file information (service) stored in the device 70 to a communication partner device. The file server computer device 70 is assigned an IP address 71 and a MAC address 72. The file information includes, for example, an attached file attached to the mail text.

Next, the operation of the network communication management apparatus 1 according to the first embodiment described above will be described based on the step flows of FIGS.
First, the operation of the communication record collection specifying unit 12 will be described with reference to FIG.
The personal computer device 50 starts communication for connection to the mail server computer device 60 connected to the network switch device 40 through the TCP / IP network 20 (step S101).

  Subsequently, the security monitoring device 30 that has been monitoring communication in the TCP / IP network 20 detects communication to the mail server computer device 60 and sends the detected communication content of the TCP / IP network 20 to the security monitoring device 30. It records as a communication record (refer FIG. 5) to the equipped communication recording part 32 (step S102).

  Subsequently, the communication record collection specifying unit 12 of the communication management device 10 collects the communication record (see FIG. 5) recorded in the communication recording unit 32 from the security monitoring device 30, and performs communication based on the collected record. The IP address 51 that is the IP address of the executed transmission source, the IP address 61 that is the IP address of the transmission destination where the communication has been executed, and the authentication identifier hogehoge@uuuu.nnnn are specified (step S103).

  Further, the communication record collection specifying means 12 is a mail receiver information table 18 (see FIG. 4) in which information indicating the correspondence between each personal computer device and the mail address of the mail recipient is stored in the device having the IP address 51. ) (Step S104).

  The communication record collection specifying unit 12 specifies the personal computer device 50 having the IP address 51 and its authentication identifier aaaaa@xxx.ddd from the devices extracted in step S104 (step S105).

  The communication record collection specifying unit 12 is a personal computer having the authentication identifier of the device having the IP address 51 of the communication record collected from the communication recording unit 32 of the security monitoring device 30 and the IP address 51 extracted from the mail recipient information table 18. It is determined whether or not the authentication identifier of the device 50 matches, and it is specified that the two authentication identifiers do not match (step S106).

  Then, the communication management device 10 determines that the device having the IP address 61 is connected to the device having the IP address 61 by an unauthorized means, and blocks communication to the device having the IP address 61. Is determined (step S107).

Next, the operation of the device search means 13 will be described based on FIGS.
The device search means 13 of the communication management device 10 uses the IP address 16A and the subnet mask 16B stored in the device connection information table 16 (see FIG. 2) indicating the connection configuration of each network switch device and the server computer device. Each network address is obtained, and the network switch device having the same IP address as the IP address 61 extracted by the communication record collection specifying unit 12 is extracted from the device connection information table 16 (step S201).

  The device search means 13 collects the switch device address resolution table 48 from each network switch device extracted in step S201 (step S202).

  The device search means 13 extracts the destination IP address from the switch device address resolution table 48 (see FIG. 6) collected in step S202, and includes the MAC address 62 corresponding to the destination IP address 61 where the communication has been executed. The network switch device 40 having the switch device address resolution table 48 that has been specified is specified (step S203).

  Subsequently, the device search means 13 extracts each port name 16C, connection destination device name 16D, and IP address 16E of the connection destination device specified in step S203 from the device connection information table 16 (step S203). S204).

  The device search means 13 specifies that the connection destination of the device with the IP address 61 is the port 41 of the network switch device 40 (step S205).

  Further, the device search means 13 extracts the IP address of the device connected to the network switch device 40 identified in step S203 from the device connection information table 16 (step S206).

  The device search means 13 specifies the mail server computer device 60 that is the device of the IP address 61 that is connected to the network switch device 40 specified in step S203 (as specified also in FIG. 2) (step S203). S207: See FIG.

  Further, the device search means 13 extracts the same type of device as the mail server computer device 60 identified in step S207 from the device information table 17 (device type 17A in FIG. 3) (step S208).

  The device search means 13 identifies the file server computer device 70 that is the same type of “mail server” as the mail server computer device 60 identified in step S207 (step S209).

  Further, the device search means 13 obtains the network address of each device from the IP address 16A and the subnet mask 16B stored in the device connection information table 16, and the same network address portion as the file server computer device 70 identified in step S209. The network switch device having the IP address is extracted from the device connection information table 16 (step S210).

  The device search means 13 identifies the network switch device 40 having the same network address part IP address as the file server computer device 70 (step S211).

Further, the device search means 13 extracts each port of the network switch device 40, the connection destination device 16D, and the IP address 16E of the connection destination device specified in step S211 from the device connection information table 16 (step S212).
The device search means 13 specifies that the connection destination of the file server computer device 70 is the port 42 of the network switch device 40 (step S213).

Next, the operation of the network switch device connection cutoff control means 14 will be described with reference to FIG.
The network switch device connection cut-off control means 14 updates the use of the port recorded in the use state information 41C of the port 41 of the network switch device 40 specified by the device search means 13 from “possible” to “impossible” (step) S301).

By this update, communication from each device including the personal computer device 50 to the mail server computer device 60 is blocked (step S302).
Subsequently, the network switch device connection cutoff control unit 14 updates the use of the port recorded in the use state information 42C of the port 42 of the network switch device 40 specified by the device search unit 13 from “possible” to “impossible”. (Step S303).

  By this update, communication from each device including the personal computer device 50 to the file server computer device 70 is blocked (step S304).

Next, the operation of the network switch device connection recovery control means 15 will be described with reference to FIG.
The network switch device connection recovery control means 15 adds a rule for refusing communication from a device having the MAC address 52 to the connection (communication) rule 49 of the network switch device 40 that has been disconnected by the network switch device connection cutoff control means 14. (Step S351).

  As a result, communication from the personal computer device 50 to the mail server computer device 60 and the file server computer device 70 connected to the network switch device 40 is blocked (step S352).

  The network switch device connection recovery control means 15 changes the information of the usage state information 41C provided in the port 41 of the network switch device 40 that has been disconnected by the network switch device connection cutoff control means 14 from “impossible” to “possible”. Update (step S353).

  By this update, communication from the device other than the personal computer device 50 to the mail server computer device 60 is restored (step S354).

  Subsequently, the network switch device connection recovery control means 15 changes the information of the use state information 42C of the port 42 of the network switch device 40 that has been disconnected by the network switch device connection cutoff control means 14 from “impossible” to “possible”. Update (step S355).

  By this update, communication from the device other than the personal computer device 50 to the mail server computer device 70 is restored (step S356).

  By adopting such a configuration, after the communication management device 10 blocks communication between the mail server computer device 60 and the file computer device 70 that have been illegally accessed, unauthorized access to the mail server computer device 60 is made. Even if the executed personal computer device 50 and other personal computer devices try to access the file server computer device 70 and the mail server computer device 60 again, communication with them becomes impossible and the personal computer device is physically disconnected from the network. Therefore, the leakage of e-mail information or the spread of tampering can be prevented. This is because, by making the communication of the device inexecutable, a device that performs unauthorized access is not connected to the network, and therefore the influence of unauthorized access due to reconnection of the device is not affected.

[Second Embodiment]
Hereinafter, a second embodiment of a network communication management apparatus according to the present invention will be described with reference to the accompanying drawings.

  A network communication management apparatus 2 shown in FIG. 13 includes a communication management apparatus 10 that manages communication of the system, a security monitoring apparatus 30 that monitors communication of the TCP / IP network 20, and a network having a connection interface function of the apparatus. The switch devices 40 and 80, the mail server computer device 60 and the file server computer device 70 which are devices for communicating with other devices and providing services, and the personal computer device which is a device for communicating with other devices 50 and a TCP / IP network 20 connecting these devices. In the second embodiment, a network switch device 80 is provided between the network switch device 40 and the file server computer device 70. In addition, about the part which attached | subjected the code | symbol same as 1st Embodiment mentioned above, the same or an equivalent part is shown, The description is the same.

  The network switch device 80 constituting the network communication management device 2 is a device that realizes communication by wire, and includes a port 81 and a port 82, and these have a function as a connection interface of the device. An IP address 81A and a MAC address 81B are assigned to the port 81, and an IP address 82A and a MAC address 82B are assigned to the port 82.

  Further, the ports 81 and 82 include usage state information 81C and 82C, and it is determined by the information set here whether each port is usable or unusable. If the usage state is “possible”, communication is possible when the device is connected, and if the usage state is “impossible”, communication is impossible even if the device is connected. The contents of the usage state information 81C and 82C can be acquired and updated from devices other than the network switch device.

  The network switch device 80 has a switch device address resolution table 88. As shown in FIG. 17, the switch device address resolution table 88 stores a correspondence table of IP addresses (source IP addresses) and MAC addresses (source MAC addresses) included in communication in the network switch device 80. Has been.

  As shown in FIG. 13, in this embodiment, the network switch device 40 is connected to the port 81 of the network switch device 80, and the file server computer device 70 is connected to the port 82. The network switch device 80 connects the network switch device 40 and the file server computer device 70 by wire, and has a port 81 having a connection interface function with the network switch device 40 and a connection interface function with the file server computer device 70. A port 82 having

  The network switch device 40 configuring the network communication management device 2 is a device that implements wired communication as described in the first embodiment, and has a function as a connection interface of the device. In the second embodiment, the mail switch computer device 60 is connected to the port 41 and the network switch device 80 is connected to the port 42 in the network switch device 40.

Next, the operation of the network communication management apparatus 2 according to the second embodiment described above will be described based on the step flows of FIGS.
First, the operation content of the communication record collection specifying unit 12 is the same as the operation content (FIG. 8) of the first embodiment.

Next, the operation of the device search means 13 will be described based on FIGS.
As shown in FIG. 18, the device search means 13 provided in the communication management device 10 has an IP stored in a device connection information table 16 (see FIG. 14) indicating the connection configuration of each network switch device and the server computer device. The network address of each device is obtained from the address 16A and the subnet mask 16B, and the network switch device having the IP address of the same network address portion as the IP address 61 extracted by the communication record collection specifying means 12 is obtained from the device connection information table 16. Extract (step S201).

  The device search means 13 collects the switch device address resolution table 48 from each network switch device extracted in step S201 (step S202).

  The device search means 13 extracts the destination IP address from the switch device address resolution table 48 (FIG. 16) collected in step S202, and includes the MAC address 62 corresponding to the destination IP address 61 with which communication has been performed. The network switch device 40 having the existing switch device address resolution table 48 is specified (step S203).

  Subsequently, the device search means 13 extracts each port name 16C, connection destination device name 16D, and IP address 16E of the connection destination device specified in step S203 from the device connection information table 16 (step S203). S204).

  The device search unit 13 determines whether or not the destination IP address 61 acquired by the communication record collection specifying unit 12 is included in the IP address 16E of the connection destination device extracted in step S204 (step S401). ). As a result of the determination, if the IP address 61 is included in the IP address of the connection destination device, the process proceeds to step S403, and if not, the process proceeds to step S402. In this embodiment, since the IP address 61 is included in the extracted IP address of the connection destination device, the process proceeds to step S403.

  If the process proceeds to step S402 at the branch of step S401, as shown in FIG. 19, whether or not a device whose type is “switch” is included in the extracted connection destination device name 16D. Is determined (step S402). If the result of determination is that a “switch” device is included, the process returns to step S204. On the other hand, if the “switch” device is not included, the process proceeds to step S403.

  The device search unit 13 extracts the device having the IP address determined in step S401 from the device information table 17 (FIG. 15), and determines whether the device type 17A is “server” (step S403). As a result of the determination, if the device is a “server” device, the process proceeds to step S404. If the device is not a “server” device, an error determination is made and the process ends. In this embodiment, since the device type of the IP address 61 is “server”, the process proceeds to step S404.

  The device search means 13 is a device connected to the network switch device 40 identified in step S203, and identifies the mail server computer device 60 with the IP address 61 and the connection destination port 41 (step S404).

  Subsequently, the device search means 13 extracts from the device information table 17 (FIG. 15) the device of “server” which is the same device type 17A as the mail server computer device 60 identified in step S404 (step S405).

  The device search means 13 specifies the same type of file server computer device 70 as the mail server computer device 60 and its IP address 71 from the extracted server device (step S406).

  Subsequently, as shown in FIG. 20, the device search means 13 extracts the network switch device to which the mail server computer device 60 is connected from the device connection information table 16 (FIG. 14) (step S407).

  The device search means 13 identifies the network switch device 40 from the network switch devices extracted in step S407 (step S408).

  Subsequently, the device search means 13 is connected to each port name 16C of the network switch device 40, assuming that the file server computer device 70 having the IP address 71 is connected to the network switch device 40 identified in step S408. The destination device name 16D and the IP address 16E of the destination device are extracted from the device connection information table 16 (FIG. 14) (step S409).

  The device search means 13 determines whether or not the IP address 16E of the connection destination device extracted in step S409 includes the IP address 71 specified in step S406 (step S410). As a result of the determination, if the IP address 71 is included, the process proceeds to step S412. If the IP address 71 is not included, the process proceeds to step S411. In this form, since the IP address 71 is not included in the extracted IP address of the connection destination device, the process proceeds to step S411.

  The device search means 13 determines whether or not the connection destination device extracted in step S409 includes a device whose device type is “switch” with reference to the device information table 17 (FIG. 15). (Step S411). As a result of the determination, if a device of “switch” is included, the network switch device targeted in step S409 is changed to the network switch device extracted by the determination, and the process returns to step S409. On the other hand, if a “switch” device is not included, an error determination is made and the process ends.

  In this embodiment, the connection destination device name 16D extracted in step S409 includes “mail server computer device 60” and “network switch device 80”, and the device type “switch” among them is the device information table. When extracted with reference to FIG. 17 (FIG. 15), “network switch device 80” corresponds. Therefore, the network switch device targeted in step S409 is changed to the extracted network switch device 80, and the process returns to step S409.

  Returning to step S409, the device search means 13 obtains the port name 16C, the connection destination device name 16D, and the IP address 16E of the connection destination device of the network switch device 80 identified in step S411 from the device connection information table 16 (FIG. 14). Extract (step S409).

  The device search means 13 determines whether or not the IP address 16E of the connection destination device of the network switch device (network switch device 80) extracted in step S409 includes the IP address 71 specified in step S406 (step S410). ). In this embodiment, since the IP address 71 (16F) is included in the IP address of the connection destination device of the network switch device 80 extracted this time, the process proceeds to step S412.

  Subsequently, as shown in FIG. 21, the device search unit 13 determines whether or not the type of the device (connection destination device) having the IP address 71 determined in step S410 is “server”. The determination is made with reference to FIG. 15 (step S412). In this embodiment, since the device type 17A having the IP address 71 is “server (file server computer device 70)”, the process advances to step S413. If the type of device is not “server”, an error determination ([No] branch) is made and the process is terminated.

  The device search means 13 specifies that the device to which the device having the IP address 71 is connected is the network switch device 80 from the network switch devices extracted in step S409 (step S413).

  Further, the device search means 13 refers to the device information table 17 (FIG. 15) and specifies that the device having the IP address 71 is the “file server computer device 70” (step S414).

  Subsequently, the device search unit 13 extracts the port name 16C, the connection destination device name 16D, and the IP address 16E of the connection destination device of the network switch device 80 from the device connection information table 16 (FIG. 14) (step S415).

  The device search means 13 specifies the network switch device 80 and the connection destination port 82 of the connection destination of the file server computer device 70 specified in step S414 (step S416), and ends the processing.

The operation of the network switch device connection cutoff control means 14 will be described with reference to FIG.
The network switch device connection cut-off control means 14 updates the use of the port recorded in the use state information 41C of the port 41 of the network switch device 40 specified by the device search means 13 from “possible” to “impossible” (step) S301).

  By this update, communication from each device including the personal computer device 50 to the mail server computer device 60 is blocked (step S302).

  Subsequently, the network switch device connection cutoff control unit 14 updates the use of the port recorded in the use state information 82C of the port 82 of the network switch device 80 specified by the device search unit 13 from “possible” to “impossible”. (Step S501).

  By this update, communication from each device including the personal computer device 50 to the file server computer device 70 is blocked (step S304).

  In the case of such a configuration as well, as in the first embodiment, after the communication management apparatus 10 blocks communication between the mail server computer apparatus 60 and the file computer apparatus 70 that have been illegally accessed, the mail server computer Even if the personal computer device 50 and other personal computer devices that have performed unauthorized access to the device 60 try to access the file server computer device 70 and the mail server computer device 60 again, communication with them becomes impossible. Since it is physically separated from the network, it is possible to prevent the leakage of e-mail information or the spread of tampering again. This is because, by making the communication of the device inexecutable, a device that performs unauthorized access is not connected to the network, and therefore the influence of unauthorized access due to reconnection of the device is not affected.

  Here, part or all of the functions executed by the respective components of the network communication management apparatus according to the embodiment of the present invention may be constructed as a program, and the program may be executed by the computer. In this case, the same effect as that described in the above embodiment can be obtained.

  About each embodiment mentioned above, if the summary of the novel technical content is put together, it will become as follows. A part or all of the above-described embodiment is as follows as a novel technique, but the present invention is not necessarily limited to this.

(Supplementary Note 1) Personal computer device that performs communication via a network, server computer device that responds to communication corresponding thereto, and a connection interface of the server computer device that is interposed between the server computer device and the network A network communication management device connected via a network to each of a functioning network switch device and a security monitoring device that monitors network communication,
A personal computer that collects communication records of the security monitoring device, determines whether or not unauthorized communication has been executed based on the communication records, and executes unauthorized communication when it is determined that unauthorized communication has been executed Communication record collection specifying means for specifying the device and the server computer device that responded to the unauthorized communication;
A network switch device connection cut-off control means for changing the network switch device to which the identified server computer device is connected from the usable state to the unusable state and controlling the connection with the network;
A network communication management apparatus comprising:

(Appendix 2) The network switch device is provided with a plurality of ports, and the server computer device is connected to the ports,
The network switch device connection cut-off control means changes the port to which the server computer device responding to the unauthorized communication is connected from an available state to an unusable state and responds to the unauthorized communication. 2. The network communication management device according to claim 1, wherein the network communication management device is configured to block connection with the network.

(Appendix 3) The communication record collection specifying means
From the communication record of the security monitoring device, the IP address of the transmission source device that has performed communication, the IP address of the transmission destination device that responded to the communication, and the authentication identifier are identified, and the mail recipient information is recorded in advance. A function of identifying a personal computer device having an IP address of the transmission source device and an authentication identifier thereof, and determining that an unauthorized communication is performed when the specified authentication identifiers do not match The network communication management device according to appendix 1 or 2, wherein the network communication management device is provided.

(Appendix 4) A plurality of the network switch devices are connected to the network,
A network switch device connected to a server computer device having an IP address of the destination device from the device connection information table in which information of a connection configuration between the network switch device and the server computer device is recorded in advance, and the network switch Appendix 3 characterized by comprising a network switch device to which a server computer device that has responded to the unauthorized communication is extracted and a device search means for identifying the port of the network switch device. The network communication management device described.

(Supplementary Note 5) Personal computer device that performs communication via a network, server computer device that responds to communication corresponding thereto, and a connection interface between the server computer device and the network that is interposed between the server computer device and the network A network communication management device connected via a network to each of a functioning network switch device and a security monitoring device that monitors network communication,
Collect communication records of the security monitoring device, determine whether unauthorized communication has been executed based on the collected communication records, and execute the unauthorized communication when it is determined that unauthorized communication has been executed Identifying the personal computer device and the server computer device that responded to the unauthorized communication, the collection, determination, and specific processing operations are executed by the communication record collection specifying means,
The network switch device connection cut-off control means changes the network switch device to which the specified server computer device is connected from the usable state to the unusable state, thereby controlling the connection with the network. Network communication management method.

(Appendix 6) The network switch device is provided with a plurality of ports, and the server computer device is connected to the ports,
The server computer apparatus in which the network switch apparatus connection cut-off control means responds to the unauthorized communication by changing the port to which the server computer apparatus responding to the unauthorized communication is connected from the usable state to the unusable state. 6. The network communication management method according to appendix 5, wherein the connection with the network is cut off.

(Supplementary note 7) From the communication record of the security monitoring device, the IP address of the transmission source device that has performed communication, the IP address of the transmission destination device that responded to the communication, and the authentication identifier are specified, and mail recipient information is recorded in advance. Identifying a personal computer device having the IP address of the transmission source device and its authentication identifier from the existing table, and determining that the two authentication identifiers do not coincide with each other when unauthorized communication is executed. 7. The network communication management method according to appendix 5 or 6, wherein the communication record collection / identification means executes each processing operation of identification and determination.

(Appendix 8) A plurality of the network switch devices are connected to the network,
In addition, information on the connection configuration between the network switch device and the server computer device is stored in advance in a device connection information table,
Based on the information stored in the device connection information table, the network switch device to which the server computer device having the IP address of the destination device is connected and the port of the network switch device are extracted, and the unauthorized communication is performed. APPENDIX 7 characterized in that the device search means executes the extraction and the specific processing operations for specifying the network switch device to which the responding server computer device is connected and the port of the network switch device. The communication management method for networks described in 1.

(Supplementary Note 9) Personal computer device that performs communication via a network, server computer device that responds to communication corresponding thereto, and a connection interface between the server computer device and the network that is interposed between the server computer device and the network A network communication management device connected via a network to each of a functioning network switch device and a security monitoring device that monitors network communication,
A communication record collection determination function for collecting communication records of the security monitoring device and determining whether unauthorized communication has been executed based on the collected communication records;
A device specifying function for specifying a personal computer device that has executed the unauthorized communication and a server computer device that has responded to the unauthorized communication when it is determined that the unauthorized communication has been executed;
And a network switch device connection cut-off control function for changing the network switch device to which the specified server computer device is connected from the usable state to the unusable state to cut off the connection with the network,
A network communication management program characterized in that a computer realizes these functions.

(Appendix 10) The network switch device is provided with a plurality of ports, and the server computer device is connected to the ports,
A network that cuts off the connection between the server computer device that responds to the unauthorized communication by changing the port to which the server computer device that responds to the unauthorized communication is connected from an available state to an unusable state The network communication management program according to appendix 9, wherein a switch device connection cutoff control function is provided and the computer is made to realize this function.

(Supplementary Note 11) A communication record specifying function for specifying the IP address of the transmission source device that has performed communication from the communication record of the security monitoring device, the IP address of the transmission destination device that responded to the communication, and the authentication identifier;
A recipient specifying function for specifying a personal computer device having an IP address of the transmission source device and its authentication identifier from a table in which mail recipient information is recorded in advance;
And providing an unauthorized communication determination function for determining that unauthorized communication is executed when the specified authentication identifiers do not match,
The network communication management program according to appendix 9 or 10, characterized in that the computer realizes these functions.

(Additional remark 12) The said network switch apparatus is connected to the said network,
In addition, information on the connection configuration between the network switch device and the server computer device is stored in advance in a device connection information table,
Based on the information stored in the device connection information table, the network switch device to which the server computer device having the IP address of the destination device is connected and the port of the network switch device are extracted and responded to the unauthorized communication 12. The network according to appendix 11, wherein a network switch device to which the server computer device is connected and a device search function for specifying a port of the network switch device are provided, and this function is realized by the computer. Communication management program.

  For example, it can be used for applications such as blocking an unauthorized device from a management target network in cooperation with device management software of a network intrusion detection device.

DESCRIPTION OF SYMBOLS 1, 2 Network communication management apparatus 10 Communication management apparatus 11 Apparatus connection structure management means 12 Communication record collection identification means 13 Apparatus search means 14 Network switch apparatus connection cutoff control means 15 Network switch apparatus connection restoration control means 16 Apparatus connection information table 17 Device information table 18 Mail recipient information table 20 TCP / IP network 30 Security monitoring device 31, 41A, 42A, 51, 61, 71, 81A, 82A IP address 32 Communication recording unit 40 Network switch device 41, 42 Ports 41B, 42B , 52, 62, 72, 81B, 82B MAC address 41C, 42C, 81C, 82C Usage status information 48, 88 Switch device address resolution table 49 Communication rule 50 Personal computer device 6 Mail server computer system 70 file server computer apparatus 80 network switching device

Claims (10)

Personal computer device that performs communication via a network, server computer device that responds to communication corresponding thereto, and network switch that is interposed between the server computer device and the network and functions as a connection interface of the server computer device A network communication management device connected via a network to each of the device and a security monitoring device that monitors network communication,
A personal computer that collects communication records of the security monitoring device, determines whether or not unauthorized communication has been executed based on the communication records, and executes unauthorized communication when it is determined that unauthorized communication has been executed Communication record collection specifying means for specifying the device and the server computer device that responded to the unauthorized communication;
A network switch device connection cut-off control means for changing the network switch device to which the identified server computer device is connected from the usable state to the unusable state and controlling the connection with the network;
A network communication management apparatus comprising: The network switch device is provided with a plurality of ports, and the server computer device is connected to the ports,
The network switch device connection cut-off control means changes the port to which the server computer device responding to the unauthorized communication is connected from an available state to an unusable state and responds to the unauthorized communication. The network communication management apparatus according to claim 1, wherein the network communication management apparatus is configured to block connection between the network and the network. The communication record collection specifying means includes:
From the communication record of the security monitoring device, the IP address of the transmission source device that has performed communication, the IP address of the transmission destination device that responded to the communication, and the authentication identifier are identified, and the mail recipient information is recorded in advance. A function of identifying a personal computer device having an IP address of the transmission source device and an authentication identifier thereof, and determining that an unauthorized communication is performed when the specified authentication identifiers do not match The network communication management device according to claim 1, wherein the network communication management device is a network management device. A plurality of the network switch devices are connected to the network,
A network switch device connected to a server computer device having an IP address of the destination device from the device connection information table in which information of a connection configuration between the network switch device and the server computer device is recorded in advance, and the network switch 4. A network switch device to which a server computer device responding to the unauthorized communication is extracted, and device search means for specifying the port of the network switch device are provided. A communication management device for a network as described in 1. Personal computer device that performs communication via a network, server computer device that responds to communication corresponding thereto, and network switch that is interposed between the server computer device and the network and functions as a connection interface of the server computer device A network communication management device connected via a network to each of the device and a security monitoring device that monitors network communication;
Collect communication records of the security monitoring device, determine whether unauthorized communication has been executed based on the collected communication records, and execute the unauthorized communication when it is determined that unauthorized communication has been executed Identifying the personal computer device and the server computer device that responded to the unauthorized communication, the collection, determination, and specific processing operations are executed by the communication record collection specifying means,
The network switch device connection cut-off control means changes the network switch device to which the specified server computer device is connected from the usable state to the unusable state, thereby controlling the connection with the network. Network communication management method. The network switch device is provided with a plurality of ports, and the server computer device is connected to the ports,
The server computer apparatus in which the network switch apparatus connection cut-off control means responds to the unauthorized communication by changing the port to which the server computer apparatus responding to the unauthorized communication is connected from the usable state to the unusable state. 6. The network communication management method according to claim 5, wherein the connection between the network and the network is cut off.   From the communication record of the security monitoring device, the IP address of the transmission source device that has performed communication, the IP address of the transmission destination device that responded to the communication, and the authentication identifier are specified, and the mail recipient information is recorded in advance from the table Identifying the personal computer device having the IP address of the transmission source device and its authentication identifier, and determining that the two authentication identifiers do not coincide with each other when unauthorized communication is executed, and The network communication management method according to claim 5 or 6, wherein each processing operation of determination is executed by the communication record collection and identification unit. A plurality of the network switch devices are connected to the network,
In addition, information on the connection configuration between the network switch device and the server computer device is stored in advance in a device connection information table,
Based on the information stored in the device connection information table, the network switch device to which the server computer device having the IP address of the destination device is connected and the port of the network switch device are extracted, and the unauthorized communication is performed. The apparatus search means executes the extraction and the specific processing operations for specifying the network switch device to which the responding server computer device is connected and the port of the network switch device. The network communication management method according to claim 7. Personal computer device that performs communication via a network, server computer device that responds to communication corresponding thereto, and network switch that is interposed between the server computer device and the network and functions as a connection interface of the server computer device A network communication management device connected via a network to each of the device and a security monitoring device that monitors network communication;
A communication record collection determination function for collecting communication records of the security monitoring device and determining whether unauthorized communication has been executed based on the collected communication records;
A device specifying function for specifying a personal computer device that has executed the unauthorized communication and a server computer device that has responded to the unauthorized communication when it is determined that the unauthorized communication has been executed;
And a network switch device connection cut-off control function for changing the network switch device to which the specified server computer device is connected from the usable state to the unusable state to cut off the connection with the network,
A network communication management program characterized in that a computer realizes these functions. The network switch device is provided with a plurality of ports, and the server computer device is connected to the ports,
A network that cuts off the connection between the server computer device that responds to the unauthorized communication by changing the port to which the server computer device that responds to the unauthorized communication is connected from an available state to an unusable state 10. The network communication management program according to claim 9, wherein a switch device connection cutoff control function is provided, and the function is realized by the computer.

Images