JP2016143397A - Terminal detection system and method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To detect an unauthorized or abnormal terminal.SOLUTION: The system detects a terminal 11. A property information comparison unit 17 compares first communication property information showing a communication property of a previously defined terminal with second communication property information of the detected terminal. When the second communication property information is different from the first communication property information as a result of a comparison result, an unauthorization/abnormality determination unit 18 recognizes the detected terminal as an unauthorized terminal.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a system and method for detecting an unauthorized or abnormal terminal.

  In recent years, it has been required to improve security by performing authentication without impairing user convenience. For example, a risk-based authentication technique is known as an authentication technique for that purpose (see Non-Patent Document 1 and Non-Patent Document 2). The risk-based authentication technique is a technique for performing additional authentication (for example, one-time password, secret question, etc.) when a server or the like is accessed from a terminal in a different environment. Also, the risk-based authentication technique is mainly a technique used at the time of login in a web service.

  In order to perform risk-based authentication, first, information that can be acquired by the service provider upon login by the user, for example, information on the IP address and connection time zone of the connection source, user-agent information of the browser, or connection source device Such information related to the history is stored on the service provider side, and collation regarding past information related to the accumulated user is performed. As a result, when the login environment is different from the previous connection environment (for example, when a user who normally accesses from Japan accesses from overseas), the risk of unauthorized login is considered high. Then, stronger authentication is performed (for example, an email including a disposable one-time password is separately transmitted to the user, and authentication is performed using the one-time password).

  By using risk-based authentication, ID / password authentication using a simple ID and password is performed in the usual usage environment by the user. Strong (and time-consuming) authentication can be performed. Therefore, security can be improved without impairing user convenience.

  By the way, as described above, the main purpose of using an existing technology such as a risk-based authentication technology is to enhance security without impairing user convenience. That is, such an authentication technique is applied to an area where a user is involved in authentication.

  However, there are cases where the user is not involved in authentication and the terminal to be authenticated itself requests the use of the service. In such a case, in order for the terminal to perform authentication, it is necessary to store in advance information (credit information) used for identifying the terminal. For example, in authentication called challenge / response authentication, a predetermined calculation process is performed on the challenge information from the server using the credit information stored in the terminal, the result is returned to the server, and the server verifies the result. Terminal authentication. In this case, for example, by not transmitting the credit information directly to the server, it is possible to avoid a risk that the malicious information is wiretapped by a malicious user on the network.

http://special.nikkeibp.co.jp/ts/article/aa0h/111209/ http://www.jp-bank.japanpost.jp/direct/pc/security/dr_pc_sc_riskbase.html

  However, the types of terminals connected to the network have been diversified in recent years. For example, some terminals called so-called machine-to-machine (M2M) terminals may not have a storage area for holding credit information because of terminal capability restrictions. There are also terminals that do not have the necessary computing power for authentication.

  For this reason, as information for uniquely identifying these terminals, for example, information on physical addresses assigned to the network interfaces of the terminals can be considered. A physical address is uniquely assigned globally. In addition, the terminal can be uniquely identified by acquiring information on the physical address.

  However, since the physical address can be easily changed, there is a risk of being misrepresented by a malicious user. Therefore, it is necessary to ensure that the terminal is not illegal (meaning the identity of the terminal) by means other than the physical address.

  For example, in recent years, solution providers that provide M2M services have provided terminals, gateways (GWs), networks, and platforms as dedicated ones. In these solutions, for example, by using a wired connection instead of a wireless connection, the connection to the network by a terminal outside the service provided is not allowed, thereby eliminating the connection of a malicious terminal and ensuring the identity of the terminal. doing. Therefore, unless preparation and setting of various dedicated devices are performed, there is a problem that it is not possible to prevent spoofing of a terminal by a malicious user, and as a result, a regular terminal cannot be accommodated.

  In addition, in order to make it possible to accommodate a terminal more easily without taking the trouble of preparation and setting, it is required to establish a mechanism for eliminating impersonation.

  Further, with respect to a legitimate terminal that can be authenticated, there may be a case where the terminal is hijacked due to a failure of the terminal or an attack from a malicious user. In such a case, since the authentication of the terminal succeeds, it is also required to establish a mechanism for eliminating such an abnormal terminal.

  The present invention has been made paying attention to the above circumstances, and an object of the present invention is to provide a system and a method for realizing detection of an illegal or abnormal terminal.

  In order to achieve the above object, a first aspect of the present invention includes the following components. That is, a first aspect of the present invention is a system for detecting a terminal, which includes first communication characteristic information indicating communication characteristics of a terminal defined in advance and second communication characteristic information of the detected terminal. It is a system comprising comparison means for comparison, and determination means for regarding a detected terminal as an unauthorized terminal when the second communication characteristic information is different from the first communication characteristic information based on the comparison result.

The first aspect of the present invention is characterized by further including the following aspects.
In other words, when it is determined that the detected terminal is regarded as an unauthorized terminal, the information processing apparatus further includes notification means for notifying information regarding the unauthorized terminal to a higher system.

  Further, the information processing apparatus further includes an acquisition unit configured to acquire the first communication characteristic information from a higher-order system based on information exchanged in communication between the system and the detected terminal.

  In addition, storage means for storing the first communication characteristic information acquired from the host system is further provided, and the comparison means performs comparison using the stored first communication characteristic information.

  The first aspect of the present invention also includes a method having similar components and aspects.

  That is, according to the present invention, it is possible to provide a system and method for realizing detection of an unauthorized or abnormal terminal.

The functional block diagram which shows the structural example of the terminal detection system of the 1st Embodiment of this invention. The example of the unauthorized terminal detection process sequence performed by the terminal detection system of 1st Embodiment. The figure which shows the structural example of the terminal detection system of the 2nd Embodiment of this invention. The example of the unauthorized terminal detection process sequence which inquires with respect to M2M-PF when accommodating the M2M terminal by the terminal detection system of 2nd Embodiment. The example of the unauthorized terminal detection process sequence in the case of registering the information regarding a terminal beforehand with NW-PF by the terminal detection system of 2nd Embodiment. The example of the unauthorized terminal detection process sequence performed when the terminal detection system of the 3rd Embodiment of this invention accommodates the terminal which uses IEEE802.15.4.

(First embodiment)
A first embodiment according to the present invention will be described below with reference to the drawings.
FIG. 1 is a functional block diagram illustrating a configuration example of the terminal detection system 1 according to the first embodiment.
The terminal detection system 1 includes a terminal detection function unit 10 and a terminal communication characteristic information management function unit 14. The terminal detection function unit 10 includes a communication monitoring function unit 12, a communication control function unit 13, and a communication information acquisition interface function unit 15.

  The terminal detection function unit 10 replaces the terminal 11 that does not have an authentication function in a network or a terminal management platform that requires terminal authentication in order for the terminal 11 to use a service. Processing for eliminating an illegal terminal such as 11 spoofing is performed.

  Specifically, the terminal detection function unit 10 detects a terminal 11 that communicates with the terminal detection function unit 10, and monitors communication characteristics related to the detected terminal 11. If the information indicating the communication characteristics regarding the detected terminal 11 is different from the information indicating the communication characteristics regarding the terminal including the terminal 11, the terminal 11 is regarded as an unauthorized terminal and the communication with the terminal 11 is blocked. Process to do.

  Note that the terminal defined in advance is, for example, a terminal registered in advance as a legitimate terminal that is not illegal. The communication characteristics include, for example, information related to the behavior of the terminal and information related to the behavior of the terminal. Specifically, the communication characteristics include a traffic pattern, a communication frequency, or a communication amount.

  Hereinafter, the information indicating the communication characteristics regarding the terminal 11 among the information indicating the communication characteristics regarding the terminal defined in advance is referred to as “specified terminal characteristic information”. In addition, the communication characteristic regarding the detected terminal is referred to as “communication terminal characteristic”, and information indicating the communication terminal characteristic is referred to as “communication terminal characteristic information”.

  The terminal communication characteristic information management function unit 14 holds information for each terminal, and includes, for example, specified terminal characteristic information, communication state, installation range, communication content, etc. (hereinafter referred to as “terminal related information”) regarding the terminal 11. Hold). The information held by the terminal communication characteristic information management function unit 14 is information registered in advance, for example.

  The communication information acquisition interface function unit 15 includes an acquisition unit 16. The acquisition unit 16 acquires specified terminal characteristic information and the like from the terminal characteristic information management function unit 14. In addition, the acquisition unit 16 obtains specified terminal characteristic information and the like based on information exchanged in the communication between the terminal detection function unit 10 and the terminal 11 as a terminal communication characteristic information management function unit 14 that is one of the upper systems. Get from. For example, the acquisition unit 16 uses the media access control (MAC) frame in the IEEE 802.15.4 wireless connection used between the terminal detection function unit 10 and the terminal 11 to specify the specified terminal characteristic information and the like on the terminal communication characteristic. Obtained from the information management function unit 14. Then, the communication information acquisition interface function unit 15 transmits the acquired specified terminal characteristic information and the like to the communication monitoring function unit 12. In the following description, it is assumed that the host system is the terminal communication characteristic information management function unit 14.

  The communication monitoring function unit 12 monitors communication related to the terminal 11. Also, the specified terminal characteristic information is received from the communication information acquisition interface function unit 15.

  The communication monitoring function unit 12 includes, for example, a characteristic information comparison unit 17, an unauthorized abnormality determination unit 18, a notification unit 19, and a characteristic information storage unit 20.

  The characteristic information comparison unit 17 performs processing for comparing the specified terminal characteristic information received from the communication information acquisition interface function unit 15 with the communication terminal characteristic information obtained based on the monitoring result. Alternatively, a process for comparing the stored specified terminal characteristic information with the communication terminal characteristic information obtained based on the monitoring result using the specified terminal characteristic information stored in the characteristic information storage unit 20 described later. I do.

  Based on the result of the comparison process by the characteristic information comparison unit 17, the fraud abnormality determination unit 18 has the same communication terminal characteristic information obtained from the monitoring result as the specified terminal characteristic information received from the communication information acquisition interface function unit 15. Processing for determining whether or not there is present is performed. If the communication terminal characteristic information is different from the specified terminal characteristic information based on the determination result, the terminal 11 is regarded as an unauthorized terminal. Further, based on the determination result, when the communication terminal characteristic information is the same as the specified terminal characteristic information, the terminal 11 is regarded as a valid terminal.

  In addition, when it is determined that the terminal 11 is regarded as an unauthorized terminal, the unauthorized abnormality determination unit 18 instructs the communication control function unit 13 to block communication with the terminal 11.

  In the determination process by the fraud abnormality determination unit 18, the communication terminal characteristic information may not be the same as the specified terminal characteristic information. For example, the fraud abnormality determination unit 18 may perform processing for determining whether or not the communication terminal characteristic information corresponds to or corresponds to the specified terminal characteristic information.

  In addition, an unauthorized terminal is not only a terminal impersonating a legitimate terminal, but also an abnormal terminal having communication characteristics different from the original characteristic information of the terminal 11 due to, for example, a failure of the terminal 11 or an attack on the terminal 11 Including.

  When it is determined that the terminal 11 is regarded as an unauthorized terminal, the notification unit 19 notifies the host system of information related to the unauthorized terminal. In addition, the information regarding an unauthorized terminal is not information regarding the terminal 11 which is a valid terminal, but is information regarding the unauthorized terminal 11. For example, the information related to the unauthorized terminal is different from the information related to the legitimate terminal 11 held in the terminal communication characteristic information management function unit 14 or the like.

  The characteristic information storage unit 20 stores specified terminal characteristic information acquired from a higher system via the acquisition unit 16 and the like.

  When the communication control function unit 13 receives an instruction for blocking communication with the terminal 11 from the communication monitoring function unit 12, the communication control function unit 13 performs processing for blocking communication with the terminal 11.

  Each of these functional units is, for example, a server / database / application, and is described as an independent entity. However, in any combination, implementation as the same entity is not limited. For example, the communication information acquisition interface function unit 15 may not be included in the terminal detection function unit 10.

  The terminal detection system 1 according to the first embodiment reads a program recorded on a recording medium such as a magnetic disk or a program downloaded via a communication network such as the Internet, and the operation is controlled by this program. This is realized by a computer such as a server.

  In the claims, the comparison means for comparing the first communication characteristic information indicating the communication characteristic of the terminal defined in advance with the second communication characteristic information of the detected terminal corresponds to, for example, the characteristic information comparison unit 17. . Based on the comparison result, when the second communication characteristic information is different from the first communication characteristic information, a determination unit that regards the detected terminal as an unauthorized terminal corresponds to, for example, the unauthorized abnormality determination unit 18.

  Further, in the claims, when it is determined that the detected terminal is regarded as an unauthorized terminal, a notification means for notifying information related to the unauthorized terminal to a higher-level system corresponds to, for example, the notification unit 19.

  Further, in the claims, the acquisition means for acquiring the first communication characteristic information from the host system based on the information exchanged in the communication between the system and the detected terminal corresponds to, for example, the acquisition unit 16. .

  Further, in the claims, storage means for storing the first communication characteristic information acquired from the host system corresponds to, for example, the characteristic information storage unit 20.

Next, an unauthorized terminal detection processing sequence performed by the terminal detection system 1 of the first embodiment will be described with reference to FIG.
First, the terminal 11 makes a communication request to the communication monitoring function unit 12 (step S20). In response to a communication request from the terminal 11, the communication monitoring function unit 12 acquires terminal identification information used for terminal identification from the terminal 11 or the like.

  Next, the communication monitoring function unit 12 requests the terminal communication characteristic information management function unit 14 to acquire data including the specified terminal characteristic information (step S22). Then, in response to a request from the communication monitoring function unit 12, the terminal communication characteristic information management function unit 14 notifies the communication monitoring function unit 12 of data including the specified terminal characteristic information (Step S24).

  Next, the communication monitoring function unit 12 starts monitoring the communication with the terminal 11. Then, based on the communication terminal characteristic information obtained by monitoring and the specified terminal characteristic information acquired from the terminal communication characteristic information management function unit 14, it is determined whether or not the terminal 11 is an unauthorized terminal.

  Then, if it is determined that the terminal 11 is an unauthorized terminal, the communication monitoring function unit 12 requests the communication control function unit 13 to block communication with the terminal 11 (step S26).

  The communication control function unit 13 blocks communication with the terminal 11 in response to a request from the communication monitoring function unit 12 to block communication with the terminal 11 (step S28). For example, when a request for blocking communication with the terminal 11 is received from the communication monitoring function unit 12, the communication request from the terminal 11 is blocked.

According to the first embodiment as described above, the following effects can be obtained.
With respect to the terminal 11 connected to the network having the terminal detection system 1 or the like, it is possible to detect and eliminate an illegal terminal or an abnormal terminal that is impersonated.

  For example, when the terminal 11 cannot be authenticated or when the terminal 11 is not authenticated, an unauthorized terminal or an abnormal terminal can be detected and eliminated. Specifically, the terminal detection system 1 compares the specified terminal characteristic information with the behavior of the terminal 11 that can be detected by the terminal detection system 1, and if the behavior of the terminal 11 is different from the known behavior, the terminal 11 is illegal. It can be regarded as a secure terminal.

In addition, the terminal detection system 1 can accommodate not only the terminal 11 having a function of authenticating the terminal 11 itself but also the terminal 11 having no function of authenticating the terminal 11 itself in the network.
(Second Embodiment)
A second embodiment according to the present invention will be described below with reference to FIGS.
In the following, the description will focus on parts different from the configuration shown in the first embodiment. Therefore, the same code | symbol is attached | subjected to the element which is common in 1st Embodiment, and the overlapping description is abbreviate | omitted.

FIG. 3 is a diagram illustrating a configuration example of the terminal detection system 1 according to the second embodiment of the present invention.
In FIG. 3, an example in which the terminal 11 is accommodated in a public network or the like will be described. Further, it is assumed that the terminal 11 is an M2M terminal. The M2M terminal is a terminal that autonomously transmits / receives information to / from other terminals via a network without requiring an operation by a user or the like, for example.

  The terminal detection system 1 includes an M2M-PF 31 provided by an M2M-platform (PF) operator, an NW-PF 34 owned by or provided by a communication service provider such as a communication carrier, a router 35-A, and a router 35-B. And an M2M-gateway (GW) 30-A and an M2M-GW 30-B that accommodate the terminal 11.

  The terminal detection system 1 may not include the NW-PF 31. In this case, for example, the M2M-GW 30-A or the M2M-GW 30-B is configured to be directly connected to the M2M-PF 31. Moreover, M2M-PF31 may perform the process by NW-PF34 instead.

  Here, the correspondence with the first embodiment will be described. The M2M-PF 31 corresponds to the terminal communication characteristic information management function unit 14, the NW-PF 34 corresponds to the communication information acquisition interface function unit 15, and the M2M-GW 30-A or M2M-GW 30-B includes the communication monitoring function unit 12 and the communication. It corresponds to the control function unit 13.

Next, the unauthorized terminal detection process in the terminal detection system 1 of the second embodiment will be specifically described.
The terminal 11 which is a legitimate terminal communicates with the M2M-GW 30-A and transmits / receives a small amount of traffic data to / from the M2M-GW 30-A. Further, the M2M-GW 30-A is notified of the physical address of the M2M-GW 30-A itself as terminal identification information. The physical address is, for example, “AA: BB: CC: DD: EE: FF”.

  The M2M-GW 30-A can be connected to the NW-PF 34 on the core network 33 via the router 35-A.

  The M2M-PF 31 is a platform that provides an application (M2M APP) 32-A, M2M APP32-B, or M2M APP32-C related to M2M, and holds terminal-related information as described above with reference to FIG.

  On the other hand, the impersonation terminal 36 communicates with the M2M-GW 30-B and transmits / receives a large amount of traffic data to / from the M2M-GW 30-B. Further, the M2M-GW 30-B is notified of the physical address of the M2M-GW 30-B itself as terminal identification information. The physical address is, for example, “AA: BB: CC: DD: EE: FF”, which is the same as the physical address notified by the terminal 11. However, the physical address notified by the spoofing terminal 36 is a so-called spoofing physical address related to the physical address notified by the terminal 11.

  Further, the NW-PF 34 acquires the specified terminal characteristic information from the M2M-PF 31. Note that the specified terminal characteristic information acquired includes, for example, information on a small amount of traffic data transmitted from the terminal 11 to the M2M-GW 30-A as described above. The NW-PF 34 notifies the acquired specified terminal characteristic information to the M2M-GW 30-A or M2M-GW 30-B.

  The M2M-GW 30-B can be connected to the NW-PF 34 via the router 35-B. The M2M-GW 30-B monitors the impersonation terminal 36 that is the detected terminal. Based on the communication characteristic information regarding the impersonation terminal 36 obtained by monitoring and the specified terminal characteristic information acquired from the NW-PF 34, it is determined whether or not the impersonation terminal 36 is an unauthorized terminal.

  For example, the M2M-GW 30-B determines that the spoofed terminal 36 is an unauthorized terminal because a large amount of traffic data is transmitted and received at the spoofed terminal 36. That is, it is determined that the terminal identification information notified from the spoofing terminal 36 is different from the terminal identification information notified from the terminal 11.

Then, the M2M-GW 30-B blocks communication with the spoofing terminal 36.
Moreover, in 2nd Embodiment, the case where the M2M-PF provider holds the pair of the identification information regarding the terminal 11 and the specified terminal characteristic information in, for example, the M2M-PF 31 is assumed.

  Next, an unauthorized terminal detection processing sequence for making an inquiry to the M2M-PF 31 when an M2M terminal is accommodated by the terminal detection system 1 according to the second embodiment will be described with reference to FIG.

  Note that the terminal 11 is either a legitimate terminal or an unauthorized terminal such as spoofing, but in FIG. 3, the terminal 11 that is a legitimate terminal and the spoofed terminal 36 that is an unauthorized terminal are described separately. On the other hand, in FIG.4 and FIG.5, it demonstrates, without distinguishing the terminal 11 which is a legitimate terminal, and the impersonation terminal 36 which is an unauthorized terminal.

  First, the (M2M) terminal 11 makes a communication request to the M2M-GW 30 (step S40). In response to a communication request from the terminal 11, the M2M-GW 30 acquires terminal identification information including the physical address of the terminal 11 from the terminal 11 or the like.

  Next, the M2M-GW 30 requests the NW-PF 34 to acquire data including the specified terminal characteristic information (step S41). Further, the NW-PF 34 requests the M2M-PF 31 to acquire data including the defined terminal characteristic information in response to the request from the M2M-GW 30 (step S42).

  In response to a request from the NW-PF 34, the M2M-PF 31 acquires specified terminal characteristic information based on the terminal identification information of the terminal 11 acquired from the terminal 11 or the like. And M2M-PF31 notifies NW-PF34 of the acquired prescription | regulation terminal characteristic information (step S43).

  Next, the NW-PF 34 starts monitoring for communication with the terminal 11. And the communication terminal characteristic information obtained by monitoring is notified to M2M-PF31 (step S44). The communication terminal characteristic information notified to the M2M-PF 31 is associated with an unauthorized terminal related to the terminal 11 by the M2M-PF 31 or the like when, for example, the terminal 11 is notified of an unauthorized terminal in step 48 described later. And may be stored in the M2M-PF 31 or the like.

  Further, the NW-PF 34 determines whether or not the terminal 11 is an unauthorized terminal based on the communication terminal characteristic information obtained by monitoring and the defined terminal characteristic information acquired from the M2M-PF 31.

  Then, when it is determined that the terminal 11 is an unauthorized terminal, the NW-PF 34 requests the M2M-GW 30 to block communication with the terminal 11 (step S45).

  The M2M-GW 30 blocks communication with the terminal 11 in response to a request from the NW-PF 34 to block communication with the terminal 11 (step S46).

  Next, the M2M-GW 30 notifies the NW-PF 34 of information indicating that the terminal 11 is an unauthorized terminal, that is, information indicating that impersonation has occurred (step S47). Then, the NW-PF 34 notifies the M2M-PF 31 of information indicating that the terminal 11 is an unauthorized terminal, that is, information indicating that impersonation has occurred (step S48).

  Next, with reference to FIG. 5, an unauthorized terminal detection processing sequence in the case where information related to the terminal 11 is registered in advance in the NW-PF 34 by the terminal detection system 1 according to the second embodiment will be described.

  First, the M2M-PF 31 registers information related to the terminal 11 in advance, for example, specified terminal characteristic information, in the NW-PF 34 (step S50).

  Then, the (M2M) terminal 11 makes a communication request to the M2M-GW 30 (step S51). In response to a communication request from the terminal 11, the M2M-GW 30 acquires terminal identification information including the physical address of the terminal 11 from the terminal 11.

  Next, the M2M-GW 30 requests the NW-PF 34 to acquire data including the specified terminal characteristic information (step S52).

  In response to a request from the M2M-GW 30, the NW-PF 34 acquires the specified terminal characteristic information registered in step S50 based on the terminal identification information of the terminal 11. Then, the NW-PF 34 notifies the acquired specified terminal characteristic information to the M2M-GW 30 (step S53).

  Next, the M2M-GW 30 starts monitoring for communication with the terminal 11. Then, based on the communication terminal characteristic information obtained by monitoring and the defined terminal characteristic information notified in step S53, it is determined whether or not the terminal 11 is an unauthorized terminal.

  When the M2M-GW 30 determines that the terminal 11 is an unauthorized terminal, the M2M-GW 30 communicates with the terminal 11 with respect to a communication blocking function unit (not shown) for blocking communication provided in the M2M-GW 30, for example. A request for blocking is made (step S54). Then, the communication cut-off function unit cuts off communication with the terminal 11 in response to a request for cutting off communication with the terminal 11 (step S55).

  Next, the M2M-GW 30 notifies the NW-PF 34 of information indicating that the terminal 11 is an unauthorized terminal, that is, information indicating that impersonation has occurred (step S56). Then, the NW-PF 34 notifies the M2M-PF 31 of information indicating that the terminal 11 is an unauthorized terminal, that is, information indicating that impersonation has occurred (step S57).

  As described above, in step S46 of FIG. 4, the data including the specified terminal characteristic information is acquired by further making an inquiry to the M2M-PF 31 for acquiring the data including the specified terminal characteristic information. On the other hand, in FIG. 5, since the NW-PF 34 holds the specified terminal characteristic information in advance, the NW-PF 34 holds in advance without making an inquiry to the M2M-PF 31 for acquiring data including the specified terminal characteristic information. The specified terminal characteristic information is notified to the M2M-GW 30.

  4 and 5, the case where the M2M-GW 30 acquires the communication terminal characteristic information has been described. However, even when the M2M-PF 31 or the NW-PF 34 acquires the communication terminal characteristic information, as described above. Unauthorized terminal detection processing can be applied. For example, when the M2M-PF 31 acquires the communication terminal characteristic information regarding the unauthorized terminal detection process illustrated in FIG. 4, it is not necessary to perform the inquiry request process regarding the specified terminal characteristic information. On the other hand, when the NW-PF 34 acquires the communication terminal characteristic information, it is necessary to perform an inquiry request process to the M2M-PF 31 for the unauthorized terminal detection process shown in FIG. Does not need to perform the inquiry request processing in step S52.

  Further, the communication blocking process for blocking communication with the terminal 11 in step S46 or step S55 may be performed by the M2M-PF 31 or the NW-PF 34 instead of the M2M-GW 30. However, in order to reduce the influence on the network including the terminal detection system 1 and the like, it is preferable that the M2M-GW 30 performs the communication cutoff process.

  In addition, when the entity that acquires the communication terminal characteristic information is different from the entity that performs the communication blocking process, the message that requests the entity that performs the communication blocking process from the entity that acquires the communication terminal characteristic information to block communication Is sent out.

According to the second embodiment as described above, the following effects can be obtained in addition to the effects described above in the first embodiment.
When an unauthorized terminal is detected, the upper system M2M-PF 31 or NW-PF 34 is notified that an unauthorized terminal has been detected, and not only an unauthorized terminal such as impersonation but also a malfunction of the terminal 11 or a terminal It is also possible to detect the terminal 11 that behaves differently from the original due to the attack on the terminal 11.

  For example, the M2M-PF 31 or the NW-PF 34 can grasp the failure or abnormality of the terminal 11. Specifically, when communication is not performed at the timing of performing regular communication, when communication is performed at the timing of not performing regular communication, or data including a large amount of traffic is stored in the terminal 11. When a message is suddenly transmitted from the terminal 11, it can be considered that a failure or abnormality has occurred in the terminal 11.

  Further, even if the terminal 11 has no information other than a physical address or the like to prove the terminal itself, such as a low-capacity terminal 11 such as an M2M terminal, it is possible to detect and eliminate unauthorized terminals. It becomes.

  Moreover, since it is easy to disguise a physical address or the like, the low-capacity terminal 11 can be accommodated even in an environment where connection by an unspecified terminal such as a public M2M service is assumed.

Further, as shown in FIG. 5, by registering the prescribed terminal characteristic information in the NW-PF 34 in advance, an inquiry for obtaining the prescribed terminal characteristic information for the M2M-PF 31 is performed every time the unauthorized terminal detection process is performed. Since it is not necessary, the unauthorized terminal detection process can be performed efficiently.
(Third embodiment)
A third embodiment according to the present invention will be described below with reference to FIG.
In the following, the description will focus on parts different from the configuration shown in the first embodiment or the second embodiment. Therefore, the same code | symbol is attached | subjected to the element which is common in 1st Embodiment or 2nd Embodiment, and the overlapping description is abbreviate | omitted.

  The terminal detection system 1 according to the third embodiment performs an unauthorized terminal detection process using an IEEE 802.15.4 network. Specifically, when IEEE 802.15.4 wireless or MAC is used between the terminal 11 and the GW 61 that accommodates the terminal 11, processing for acquiring terminal identification information and blocking communication of an unauthorized terminal is performed. Do.

  FIG. 6 is an example of an unauthorized terminal detection processing sequence performed when the terminal detection system 1 according to the third embodiment accommodates the terminal 11 that uses IEEE 802.15.4.

  First, the terminal (Device) 11 sends an Association Request corresponding to the communication request in the first embodiment or the second embodiment to a GW (Coordinator) 61 (step S60). The GW 61 corresponds to the communication monitoring function unit 12 or the communication control function unit 13 in the first embodiment. In addition, the Association Request frame includes a Source Address field in which the physical address of the terminal 11 is stored.

  The GW 61 obtains a source address related to the terminal 11 from the MAC frame including the association request frame. Then, the GW 61 makes an inquiry requesting the terminal DB 62 storing the specified terminal characteristic information to acquire data including the specified terminal characteristic information, based on the value of the field of the Association Request frame including the acquired Source Address. (Step S62).

  The terminal DB 62 corresponds to the terminal communication characteristic information management function unit 14 in the first embodiment or the M2M-PF 31 in the second embodiment. Further, the terminal DB 62 may be arranged at an arbitrary location on the network such as the core network 33 in the first embodiment. The GW 61 may also function as the terminal DB 62.

  Next, the terminal DB 62 searches for terminal characteristic information corresponding to the Source Address, that is, specified terminal characteristic information. And terminal DB62 notifies the data containing prescription | regulation terminal characteristic information to GW61 based on a search result (step S64).

  Then, the GW 61 starts monitoring communication with the terminal 11. When the GW 61 detects an unauthorized terminal, the GW 61 notifies the terminal 11 of a Dissociation Notification for ending the association (connection) state with the terminal 11 (step S66). As a result, the terminal 11 ends the communication.

  Then, the GW 61 rejects or ignores the Association Request from the terminal 11, thereby rejecting subsequent participation of the terminal 11 and blocking communication (step S68).

According to the third embodiment as described above, the following effects can be obtained in addition to the effects described above in the first embodiment or the second embodiment.
For example, it is possible to detect and eliminate an unauthorized terminal or an abnormal terminal with respect to a terminal 11 with low power consumption that uses IEEE802.15.4.

  The present invention is not limited to the above embodiment. Various modifications can be made without departing from the scope of the present invention. For example, in FIG. 6, a process for preventing the inquiry as in step S <b> 62 by previously registering the defined terminal characteristic information in the GW 61 may be combined.

  In short, the present invention is not limited to the above-described embodiment as it is, and can be embodied by modifying the constituent elements without departing from the scope of the invention in the implementation stage. Further, various inventions can be formed by appropriately combining a plurality of constituent elements disclosed in the embodiment. For example, some components may be deleted from all the components shown in the embodiment. Furthermore, you may combine suitably the component covering different embodiment.

DESCRIPTION OF SYMBOLS 1 ... Terminal detection system, 10 ... Terminal detection function part, 11 ... Terminal, 12 ... Communication monitoring function part, 13 ... Communication control function part, 14 ... Terminal communication characteristic information management function part, 15 ... Communication information acquisition interface part, 16 ... acquisition unit, 17 ... characteristic information comparison unit, 18 ... injustice abnormality determination unit, 19 ... notification unit, 20 ... characteristic information storage unit, 30-A, 30-B ... M2M-GW, 31 ... M2M-PF, 32- A, 32-B, 32-C ... M2M APP, 33 ... Core network, 34 ... NW-PF, 35-A, 35-B ... Router, 36 ... Impersonation terminal, 61 ... GW (Coordinator), 62 ... Terminal DB .

Claims (8)

A system for detecting a terminal,
Comparing means for comparing the first communication characteristic information indicating the communication characteristic of the terminal defined in advance with the second communication characteristic information of the detected terminal;
Based on the comparison result, when the second communication characteristic information is different from the first communication characteristic information, a determination unit that regards the detected terminal as an unauthorized terminal;
A system comprising:   The system according to claim 1, further comprising notification means for notifying the host system of information relating to the unauthorized terminal when it is determined that the detected terminal is regarded as an unauthorized terminal.   The system according to claim 1, further comprising an acquisition unit configured to acquire the first communication characteristic information from an upper system based on information exchanged in communication between the system and the detected terminal. Storage means for storing the first communication characteristic information acquired from the host system;
The system according to claim 1, wherein the comparison means performs comparison using the stored first communication characteristic information. A method for detecting a terminal,
Comparing the first communication characteristic information indicating the communication characteristic of the terminal defined in advance with the second communication characteristic information of the detected terminal;
A method in which, based on the comparison result, when the second communication characteristic information is different from the first communication characteristic information, the detected terminal is regarded as an unauthorized terminal.   The method according to claim 5, wherein when it is determined that the detected terminal is regarded as an unauthorized terminal, information related to the unauthorized terminal is notified to an upper system.   The method according to claim 5, wherein the first communication characteristic information is acquired from an upper system based on information exchanged in communication between the detected terminal and a system that detects the terminal. Storing the first communication characteristic information acquired from the host system;
The method according to claim 5, wherein the comparison means performs comparison using the stored first communication characteristic information.

Images