JP2016072801A - Communication monitoring device and communication monitoring system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a communication monitoring device that simply and properly restricts connection by an authorized apparatus.SOLUTION: A communication monitoring device comprises: a communication unit 17 that receives, from an object apparatus connected with a network N, communication start notification when the object apparatus starts communication in a management system M; a storage unit 11 that stores a determination criterion to determine whether or not an apparatus is valid in the management system M; a determination unit 101 that determines whether or not the object apparatus is a valid apparatus in the management system M by comparing the communication start notification received by the communication unit 17 with the determination criterion 12 stored in the storage unit 11; and a communication restriction unit 102 that restricts communication by the object apparatus if the determination unit 101 has determined that the object apparatus is not a valid apparatus.SELECTED DRAWING: Figure 2

Description

  The present invention relates to a communication monitoring apparatus and a communication monitoring system for monitoring communication in a network.

  An energy management system (EMS) is known in which a control device connected to an air conditioner, lighting, watt-hour meter, etc. acquires energy usage status and power generation status to support energy management in the home (patent document). 1).

  In EMS, devices of various companies are required to communicate with a standardized protocol, but depending on the connected devices, there is a possibility of affecting the operation of the system. For example, there is a possibility that an unauthorized program created so as to follow a standard protocol is connected to the EMS from the computer and the EMS can be abused.

JP 2013-21848 A

  In order to protect the EMS from unauthorized connection, it is necessary to protect all the devices constituting the EMS, but all the devices constituting the EMS have a function of detecting and blocking unauthorized communication and all the devices. It is generally difficult to detect and block unauthorized communications.

  An object of this invention is to provide the communication monitoring apparatus and communication monitoring system which can restrict | limit unauthorized communication simply and appropriately in view of the said problem.

  In order to achieve the above object, the first aspect of the present invention is communicably connected to a device and a control device constituting a management system that manages the device by registering the device via a network. A communication monitoring device that receives from a target device connected to a network a communication start notification when the target device starts communication in the management system, and a criterion for determining whether the target device is a valid device in the management system A determination unit that determines whether the target device is a legitimate device in the management system by comparing a communication start notification received by the communication unit and a determination criterion stored in the storage unit And a communication monitoring device that restricts the communication of the target device when the determination unit determines that the target device is not a valid device. To.

  According to a second aspect of the present invention, there is provided a device, a control device that constitutes a management system that manages the device by registering the device, and a communication monitoring device that is communicably connected to the device and the control device via a network. The communication monitoring device includes: a communication unit that receives a communication start notification when the target device starts communication in the management system from the target device connected to the network; The storage unit that stores the criteria for determining whether or not the device is a legitimate device, the communication start notification received by the communication unit, and the judgment criteria stored in the storage unit are compared to determine whether the target device is legitimate in the management system. A communication unit that restricts communication of the target device when the target device is determined not to be a legitimate device by the determination unit that determines whether or not the device is a device. Characterized in that it comprises a part.

  ADVANTAGE OF THE INVENTION According to this invention, the communication monitoring apparatus and communication monitoring system which can restrict | limit the connection by an unauthorized apparatus simply and appropriately can be provided.

It is a typical block diagram explaining the fundamental structure of the communication monitoring system which concerns on embodiment of this invention. It is a block diagram explaining the basic composition of the communication monitoring device with which the communication monitoring system concerning an embodiment of the invention is provided. It is an example which illustrated the registration apparatus information used for the communication monitoring system which concerns on embodiment of this invention. It is an example which illustrated the network information used for the communication monitoring system which concerns on embodiment of this invention. It is an example which illustrated the monitoring information with which the communication monitoring system concerning an embodiment of the invention is provided. It is a sequence diagram explaining the operation example of the communication monitoring system which concerns on embodiment of this invention. It is a flowchart explaining the operation example of the communication monitoring apparatus with which the communication monitoring system which concerns on embodiment of this invention is provided.

  Next, an embodiment of the present invention will be described with reference to the drawings. In the following description of the drawings, the same or similar parts are denoted by the same or similar reference numerals, and redundant description is omitted.

(Communication monitoring system)
As shown in FIG. 1, the communication monitoring system according to the embodiment of the present invention includes a communication monitoring device 1, a control device 2, a plurality of devices 3a to 3c, a communication monitoring device 1, a control device 2, and a plurality of devices. A network N that connects the devices 3a to 3c so that they can communicate with each other, and a router 6 are provided. The router 6 is connected to, for example, a home network N and relays communication between the control device 2 and the devices 3a to 3c and the Internet 7.

  The control device 2 registers the devices 3a to 3c by mutual authentication with the devices 3a to 3c, respectively. The control device 2 configures the management system M together with the devices 3a to 3c by registering the devices 3a to 3c. The management system M is, for example, a home energy management system (HEMS) in which the control device 2 manages the amount of power used by the devices 3a to 3c, the amount of surplus power generated, and the like.

  The control device 2 is a controller in HEMS, for example. In this case, the devices 3a to 3c are respectively configured from home appliances such as an air conditioner, a refrigerator, and a lighting device, and power supply devices such as a solar battery and a storage battery. In addition, the devices 3a to 3c may include a smart meter, an electric vehicle (EV), a plug-in hybrid vehicle (PHV), a water heater, and the like. In the example illustrated in FIG. 1, the number of the devices 3 a to 3 c configuring the control device 2 and the management system M is 3, but may be a single number or a number other than three.

  The line of the network N may be wireless or wired. The network N appropriately includes relay devices such as switching hubs and access points. As shown in FIG. 1, the communication monitoring system according to the embodiment of the present invention can monitor the communication in the network N even if the unauthorized device 4 is connected to the network N. Unauthorized communication can be restricted. The network N may be connected to another device 5 such as a personal computer.

  As illustrated in FIG. 2, the communication monitoring device 1 includes a computer including a processing unit 10, a storage unit 11, a presentation unit 16, and a communication unit 17. The communication monitoring apparatus 1 executes the program stored in the storage unit 11 by the processing unit 10. The storage unit 11 includes a storage device such as a disk medium or a semiconductor memory, for example. The communication unit 17 is communicably connected to the network N, and communicates with other devices connected to the network N according to the control of the processing unit 10.

  The processing unit 10 includes a determination unit 101, a communication restriction unit 102, and a monitoring processing unit 103 as a logical structure. The processing unit 10 includes an arithmetic processing device such as a microcomputer. Each unit that the processing unit 10 has as a logical structure may be configured by integral hardware or may be configured by separate hardware.

  The determination unit 101 monitors communication in the network N from information acquired by the communication unit 17 and detects that a new device is connected to the network N. The determination unit 101 determines whether the target device is a valid device with the newly connected device as the target device. The communication restriction unit 102 restricts communication of the target device when the determination unit 101 determines that the target device is not a valid device.

  The monitoring processing unit 103 processes various calculations related to monitoring by the determination unit 101. The monitoring processing unit 103 creates a determination criterion 12 used for determining whether or not the determination unit 101 is a legitimate device, and stores it in the storage unit 11. The monitoring processing unit 103 acquires the configuration of the network N and the communication history from the communication of the network N monitored by the determination unit 101.

  The storage unit 11 stores registered device information 13, network information 14, and monitoring information 15 as determination criteria 12. The registered device information 13 is information related to the devices 3a to 3c registered in the control device 2, for example, as shown in FIG. The registered device information 13 stores the IP (Internet Protocol) address, MAC (Media Access Control) address, and device type information (instance list) of the devices 3a to 3c in association with the devices 3a to 3c, respectively.

  The control device 2 acquires the registered device information 13 from a communication start notification that is transmitted by broadcast when communication in the management system M is started so that the devices 3a to 3c enter the management system M. The communication start notification is an ARP (Address Resolution Protocol) request for requesting the target MAC address (physical address) of the control device 2.

  The registered device information 13 is acquired from the control device 2 by the monitoring processing unit 103 via the communication unit 17 and stored in the storage unit 11. The registered device information 13 is acquired by, for example, an instance list notification of “ECHONET Lite” (registered trademark), which is a standardized protocol used in HEMS. The instance list includes device type information indicating the type of each of the devices 3a to 3c registered in the control device 2.

  The network information 14 is information related to all devices connected to the network N as shown in FIG. The network information 14 is created by the monitoring processing unit 103 and stored in the storage unit 11. In the network information 14, the MAC address, IP address, device type information, and determination index are stored in association with all devices connected to the network N. The monitoring processing unit 103 acquires the MAC address, IP address, and device type information from the registered device information 13 acquired from the control device 2 or the communication start notification transmitted from each device connected to the network N.

  The determination index of the network information 14 is determined by the monitoring processing unit 103 based on the MAC address, IP address, or device type information. In the determination index, the device recorded as “router” means the router 6, and the devices recorded as “registered” mean the devices 3 a to 3 c. The device recorded as “external device” means the other device 5 that has not entered the management system M but is a valid device. In addition, the device recorded as “blocking target” means the unauthorized device 4 that has already been determined not to be a valid device by the determination unit 101.

  For example, as shown in FIG. 5, the monitoring information 15 is a determination history by the determination unit 101 that is updated each time the communication unit 17 receives a communication start notification (ARP request). The monitoring information 15 stores the transmission start date and time, the transmission source IP address, the transmission destination IP address (destination IP address), the communication analysis result, and the determination result by the determination unit 101 for each communication start notification.

  The determination unit 101 determines whether the target device is a valid device in the management system M in response to the communication unit 17 receiving the communication start notification with the device that transmitted the communication start notification as the target device. The determination unit 101 determines whether the target device is a legitimate device by comparing the communication start notification received by the communication unit 17 with the determination criterion 12.

  For example, the determination unit 101 determines that the target device is not a valid device when the destination IP address of the ARP request transmitted by broadcast is different from the IP address of the control device 2. In general, when entering the management system M, it is first necessary to mutually authenticate with the control device 2 and be registered in the control device 2. Therefore, the determination unit 101 determines that the target device that requests a MAC address other than the control device 2 is an unauthorized device.

  The communication restriction unit 102, when the determination unit 101 determines that the target device is not a legitimate device, transmits a disturbing packet that functions to interfere with communication of the target device so as to restrict communication of the target device. Send to.

  For example, the communication restriction unit 102 transmits a disturbing packet to the unauthorized device 4 that has transmitted an ARP request for requesting the MAC address of the control device 2 using an IP address other than the control device 2 as a destination address. For example, the communication restriction unit 102 transmits a fake ARP response including a MAC address different from the MAC address of the control device 2 to the unauthorized device 4 as a disturbing packet. The fake ARP response includes, for example, the MAC address of the communication unit 17 of the communication monitoring device 1 as the MAC address of the control device 2. As a result, all packets such as requests transmitted from the unauthorized device 4 to the control device 2 are transmitted to the communication unit 17 of the communication monitoring device 1. The communication unit 17 may discard all packets transmitted from the unauthorized device 4.

  The presentation unit 16 includes a display device that outputs light, images, characters, and the like, a speaker that outputs sound, and the like. In response to the determination unit 101 determining that the device is not valid with respect to the target device, the presentation unit 16 presents notification information to notify the user that an unauthorized device has been detected in the network N.

  In the embodiment of the present invention, an unauthorized (invalid) device communicates with a standardized protocol, but adversely affects the management system M that does not guarantee normal operation in the management system M. This means equipment that is supposed to be.

(Operation of communication monitoring system)
Hereinafter, an example of the operation of the communication monitoring system according to the embodiment of the present invention will be described with reference to the sequence diagram of FIG.

  For example, in step S101, the device 3a connected to the network N transmits an ARP request for requesting the MAC address of the control device 2 by broadcasting. In FIG. 6, a broken line means broadcast and indicates that an ARP request is transmitted to all devices connected to the network N. In step S102, the control device 2 transmits an ARP response including its own MAC address to the device 3a by unicast in response to the ARP request in step S101. When the control device 2 transmits an ARP response, the device 3a and the control device 2 acquire each other's MAC address and are connected to be communicable with each other.

  Similarly, when the device 3b transmits an ARP request in step S103, the control device 2 transmits an ARP response including its own MAC address to the device 3b in step S104. Similarly, in the case of other devices 5 such as a personal computer, a smartphone, and a tablet terminal, when the device 5 transmits an ARP request in step S105, the control device 2 sends an ARP response including its own MAC address to the device 5 in step S106. Send to.

  In the communication monitoring device 1, the ARP request in steps S101, S103, and S105 requests the MAC address of the control device 2, and the device 3a whose address matches the device 5 and the registered device information 13 based on the determination criterion 12. , 3b are determined to be valid devices. In this case, the communication monitoring apparatus 1 does not transmit an interference packet that restricts communication to the devices 3a and 3b and the device 5.

  For example, in step S107, the unauthorized device 4 transmits an ARP request for requesting the MAC address of the control device 2 by broadcasting. In step S108, the control device 2 transmits an ARP response including its own MAC address to the unauthorized device 4 by unicast in response to the ARP request in step S107. By the ARP response, the relay device such as the switching hub included in the unauthorized device 4 and the network N stores the MAC address of the control device 2, and the unauthorized device 4 and the control device 2 are temporarily connected to be communicable. The

  In step S107, the communication monitoring apparatus 1 detects the source MAC address or source IP address (source address) included in the ARP request from the address of the device recorded as “blocking target” in the network information 14. To do. In this case, the communication restriction unit 102 transmits a false ARP response, which is a disturbing packet, to the unauthorized device 4 in step S109 after a predetermined time has elapsed since the communication unit 17 received the ARP request in step S107. The process of step S109 can be performed, for example, several tens of ms to several seconds after receiving the ARP request in step S107, so as to be performed after the ARP response of step S108 has been reliably transmitted.

  The relay device such as the switching hub included in the unauthorized device 4 and the network N overwrites an address different from the MAC address of the control device 2 as the MAC address of the control device 2 by the false ARP response in step S109. Thereby, the communication monitoring apparatus 1 can make the unauthorized device 4 incapable of communicating with the control device 2.

  In step S110, it is assumed that the unauthorized device 4 broadcasts an ARP request that requests the MAC address of the device 3a. In step S111, the device 3a transmits an ARP response including its own MAC address to the unauthorized device 4 by unicast in response to the ARP request in step S110. By the ARP response, the relay device such as the switching hub included in the unauthorized device 4 and the network N stores the MAC address of the device 3a, and the unauthorized device 4 and the device 3a are temporarily connected to be communicable.

  In step S110, the communication monitoring apparatus 1 detects that the destination IP address included in the ARP request is different from the IP address of the control apparatus 2. In this case, the communication restriction unit 102 transmits a false ARP response that is a disturbing packet to the unauthorized device 4 in step S112 after a predetermined time has elapsed since the communication unit 17 received the ARP request in step S110.

  Due to the fake ARP response, the relay device such as the unauthorized device 4 and the switching hub included in the network N overwrites an address different from the MAC address of the control device 2 as the MAC address of the control device 2. As a result, the communication monitoring apparatus 1 can disable the unauthorized device 4 from communicating with the device 3a. The processing in steps S113 to S118 is substantially the same as the processing in steps S110 to S112 and is omitted because it overlaps.

-Operation of the communication monitoring device-
Hereinafter, an example of a basic operation of the communication monitoring apparatus 1 when an ARP request is received will be described using the flowchart of FIG.

  First, in step S <b> 21, the communication unit 17 receives an ARP request from the target device connected to the network N. In step S <b> 22, the determination unit 101 compares the ARP request received by the communication unit 17 with the determination criterion 12 stored in the storage unit 11 to determine whether the target device is a valid device in the management system M. Judging. If it is determined that the target device is valid, the process is terminated. If it is determined that the target device is not valid, the process proceeds to step S23.

  In step S <b> 23, the communication restriction unit 102 restricts communication of the target device by transmitting an interference packet including the MAC address of the communication unit 17 as a fake ARP response to the target device that is determined not to be a legitimate device. .

  According to the communication monitoring system according to the embodiment of the present invention, the communication monitoring apparatus 1 determines whether the target device is a legitimate device based on the ARP request received from the target device and the determination criterion 12. And restrict unauthorized device communication. Therefore, it is possible to easily and appropriately limit connections by unauthorized devices.

  Further, according to the communication monitoring system according to the embodiment of the present invention, the communication monitoring apparatus 1 transmits a fake ARP response including its own MAC address to an unauthorized device, thereby ensuring an unauthorized operation with a simple method. Device communication can be restricted.

(Other embodiments)
As mentioned above, although this invention was described by embodiment, it should not be understood that the description and drawing which form a part of this indication limit this invention. From this disclosure, various alternative embodiments, examples and operational techniques will be apparent to those skilled in the art.

  For example, in the above-described embodiment, it is assumed that the IP address of the unauthorized device 4 is “192.168.0.40” as shown in FIG. In this case, if the ARP request received at 12: 2: 10 is transmitted with the control device 2 as the destination, and there is no information regarding the unauthorized device 4 in the determination criterion 12, the unauthorized device 4 is valid. It will be judged that it is a proper device.

  When the unauthorized device 4 sequentially transmits ARP requests to a plurality of other devices within a predetermined time, the determination unit 101 may determine that the unauthorized device 4 is not a valid device using this communication pattern. it can. Specifically, in response to the four ARP requests immediately thereafter, the determination unit 101 increases the warning level in order of “caution”, “warning”, and “blocking” with respect to the unauthorized device 4, Thus, the unauthorized device 4 may be determined not to be a valid device.

  Further, the criterion 12 may be updated as appropriate based on information related to communication performed by the control device 2. Since requests and notifications to the control device 2 are often transmitted by unicast, the communication monitoring device 1 may not be able to receive them. For this reason, the monitoring processing unit 103 acquires information related to the communication performed by the control device 2 from the control device 2 via the communication unit 17, and transmits unnatural communication such as transmitting a plurality of requests within a predetermined time. The determination criterion 12 may be updated so that the device that performs the operation is determined to be an unauthorized device. In addition, the monitoring processing unit 103 may acquire unnatural communication of the network N from other devices connected to the network N.

  Needless to say, the present invention includes various embodiments and the like that are not described herein, such as a configuration in which the above-described configuration and operation are mutually applied. Therefore, the technical scope of the present invention is defined only by the invention specifying matters according to the scope of claims reasonable from the above description.

DESCRIPTION OF SYMBOLS 1 Communication monitoring apparatus 2 Control apparatus 3a-3c Apparatus 4 Unauthorized apparatus 5 Other apparatus 11 Memory | storage part 12 Judgment criteria 13 Registered apparatus information 17 Communication part 101 Judgment part 102 Communication restriction part

Claims (6)

A communication monitoring device that is communicably connected via a network to a device and a control device that configures a management system that manages the device by registering the device,
A communication unit that receives a communication start notification when the target device starts communication in the management system from the target device connected to the network;
A storage unit for storing a criterion for determining whether or not the device is a legitimate device in the management system;
A determination unit that determines whether the target device is a valid device in the management system by comparing the communication start notification received by the communication unit with the determination criterion stored in the storage unit; ,
A communication monitoring apparatus comprising: a communication restriction unit that restricts communication of the target device when the determination unit determines that the target device is not the valid device. The storage unit stores an address of the control device,
The communication monitoring apparatus according to claim 1, wherein the determination unit determines that the target device is not the valid device when a destination address of the communication start notification is different from an address of the control device. . The storage unit stores an address of the device registered in the control device,
The determination unit determines that the target device is a valid device when a transmission source address of the communication start notification matches an address of the registered device. The communication monitoring device described.   The communication restriction unit restricts communication of the target device by transmitting a physical address different from the physical address of the control device to the target device as a physical address of the control device. The communication monitoring apparatus according to any one of? The communication unit receives information about communication performed by the control device from the control device,
The communication monitoring apparatus according to claim 1, wherein the storage unit stores the determination criterion created based on information about communication received from the control apparatus. A device, a control device that constitutes a management system that manages the device by registering the device, and a communication monitoring device that is communicably connected to the device and the control device via a network,
The communication monitoring device includes:
A communication unit that receives a communication start notification when the target device starts communication in the management system from the target device connected to the network;
A storage unit for storing a criterion for determining whether or not the device is a legitimate device in the management system;
A determination unit that determines whether the target device is a valid device in the management system by comparing the communication start notification received by the communication unit with the determination criterion stored in the storage unit; And a communication restriction unit that restricts communication of the target device when the determination unit determines that the target device is not the legitimate device.

Images