JP2017208599A - Access restriction management device, access restriction management method, access restriction management program and information processing system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To restrict access from an attacker terminal, even when the IP address of the attacker terminal was changed.SOLUTION: An access restriction management device has a first communication unit for transmitting a first source address included in a received packet to an access controller performing access restriction based on the source address, an identification unit for identifying a first change management device from multiple change management devices each managing change of address assignment, based on the first source address, a second communication unit for transmitting the first source address to the first change management device identified by the identification unit, and a third communication unit for receiving a second source address from the first change management device which detected the fact that the address to be assigned for the source of the packet was changed from the first source address to a second source address, and transmitting the received second address to the access controller.SELECTED DRAWING: Figure 19

Description

  The present invention relates to an access restriction management technique.

  As a countermeasure against unauthorized access that occurs on the Internet, a document discloses the following technique. Specifically, the management server that analyzes the log data specifies a provider that manages the source IP (Internet Protocol) address included in the log data, and the source is determined from the IP address lending information managed by the specified provider. The client related to the IP address is specified.

  Further, as a countermeasure against an attack on a subscriber terminal from a terminal that is not permitted to communicate, a document discloses the following technique. Specifically, the security management device added on the provider network specifies the correspondence relationship between the IP address, the host name, and the connected security communication device being used by the subscriber terminal. Then, the security management device performs firewall setting for the security communication device to which the subscriber terminal is connected in accordance with the security policy of the subscriber terminal.

JP 2007-156681 A JP 2004-357234 A

  However, these documents do not disclose how to deal with a case where the address of an attacker's terminal (hereinafter referred to as an attacker terminal) actually engaged in an attack is changed.

  In one aspect, an object of the present invention is to provide a technique for restricting access from an attacker terminal even when the IP address of the attacker terminal is changed.

  An access restriction management device according to the present invention includes: a first communication unit that transmits a first transmission source address included in a received packet to an access control device that performs access restriction based on the transmission source address; From a plurality of change management devices that manage the change of the first change management device to the specifying unit that specifies the first change management device based on the first transmission source address, and the first change management device specified by the specifying unit, Second communication unit that transmits the source address of the first packet, and first change management that detects that the address assigned to the source of the packet has been changed from the first source address to the second source address A third communication unit that receives the second source address from the device and transmits the received second address to the access control device;

  In one aspect, access from the attacker terminal can be restricted even when the IP address of the attacker terminal is changed.

FIG. 1 is a diagram for explaining a case where the IP address of the attacker terminal is changed. FIG. 2 is a diagram illustrating a network configuration according to the present embodiment. FIG. 3 is a diagram showing a system overview of the enterprise system. FIG. 4 is a diagram showing a system overview of the ISP system. FIG. 5 is a functional block diagram of the change control device. FIG. 6 is a functional block diagram of the change management apparatus. FIG. 7 is a diagram illustrating an example of an attack table stored in the attack table storage unit. FIG. 8 is a diagram illustrating an example of the ISP table stored in the ISP table storage unit. FIG. 9 is a diagram illustrating an example of data managed by the access control apparatus. FIG. 10 is a diagram illustrating an example of the attack source IP table stored in the attack source IP table storage unit. FIG. 11 is a diagram illustrating an example of data managed by the subscriber management apparatus. FIG. 12 is a diagram illustrating an example of data managed by the ISP identification system. FIG. 13 is a diagram for explaining the outline of the present embodiment. FIG. 14 is a diagram illustrating a processing flow of processing executed by the change control device when an attack packet is detected. FIG. 15 is a diagram for explaining identification of an ISP system. FIG. 16 is a diagram illustrating an example of an attack table stored in the attack table storage unit. FIG. 17 is a diagram illustrating a processing flow of processing executed when the change management apparatus of the ISP system to which the attack source IP address is assigned receives the attack source IP address and the like. FIG. 18 is a diagram illustrating an example of an attack source IP table stored in the attack source IP table storage unit. FIG. 19 is a diagram illustrating a processing flow of processing executed by the change control device when the IP address assigned to the attacker terminal is changed. FIG. 20 is a diagram illustrating an example of an attack source IP table stored in the attack source IP table storage unit. FIG. 21 is a diagram illustrating an example of an attack table stored in the attack table storage unit. FIG. 22 is a diagram illustrating a processing flow of processing executed by the change control device when information on the attacker terminal is deleted. FIG. 23 is a diagram illustrating an example of an attack table stored in the attack table storage unit. FIG. 24 is a diagram illustrating a processing flow of processing executed by the change management apparatus when deleting information on an attacker terminal. FIG. 25 is a diagram illustrating an example of an attack source IP table stored in the attack source IP table storage unit. FIG. 26 is a diagram illustrating a processing flow of processing executed by the access control device when data is received from the change control device. FIG. 27 is a functional block diagram of a computer.

  A case where the IP address of the attacker terminal is changed will be described with reference to FIG. In FIG. 1, the original IP address was “ad1”. However, for example, after the attacker terminal is disconnected, the IP address assigned by ISP (Internet Service Provider) is changed to “ad2”. ing. When an attack packet including an address before change is transmitted to the public server of the enterprise system, access restriction (for example, blocking) by the access control device is not performed at first. However, after the attack packet is detected by the security device and the access restriction is set for the access control device, the attack packet does not reach the public server.

  However, when the IP address of the attacker terminal is changed, the access control device does not restrict access to the attack packet, so the attack packet reaches the public server. Therefore, the operator of the attacker terminal can avoid the access restriction by intentionally changing the IP address. In addition, since the IP address “ad1” before the change remains registered in the access control apparatus, a non-malicious third-party terminal newly assigned with the IP address “ad1” tries to access the public server. Then, access is restricted.

  Therefore, hereinafter, a method for appropriately restricting access from the attacker terminal even when the IP address of the attacker terminal is changed will be described.

  FIG. 2 shows a network configuration of the present embodiment. ISP systems 31 to 33, which are ISP information processing systems, are connected to the Internet 9. The subscriber's terminal can be connected to the Internet 9 by an IP address assigned from any of the ISP systems 31 to 33. In the present embodiment, the IP address of the attacker terminal 7 that performs a denial of service attack (also called a DoS (Denial of Service) attack) is assigned from the ISP system 31, and the attacker terminal 7 is connected to the Internet by the assigned IP address. 9 to connect to the corporate system 1.

  The ISP specifying system 5 is connected to the Internet 9. The ISP specifying system 5 performs processing for specifying the ISP system that manages the IP address assignment notified from the enterprise system 1.

  In FIG. 2, the number of ISP systems is 3, and the number of enterprise systems is 1, but the number is not limited. Further, subscriber terminals connected to the ISP systems 31 to 33 exist in addition to the attacker terminal 7, but are omitted because they are not related to the main part of the present embodiment.

  FIG. 3 shows a system overview of the enterprise system 1. The enterprise system 1 includes a change control device 10, an access control device 11, a security device 12, and a public server 13. The change control device 10, the access control device 11, the security device 12, and the public server 13 are connected by a LAN (Local Area Network) or the like.

  The access control device 11 executes processing for controlling access from the outside of the enterprise system 1 in accordance with the security policy. The security device 12 detects an attack packet transmitted by the attacker terminal 7. The attack packet detected by the security device 12 is monitored by the administrator of the enterprise system 1, and the change control device 10 receives input of information on the attacker terminal 7 from the administrator of the enterprise system 1. The change control device 10 transmits the transmission source IP address of the attacker terminal 7 to the access control device 11 and causes the access control device 11 to block the packet transmitted by the attacker terminal 7. The public server 13 is, for example, a web server, and has data and the like that are disclosed to terminals external to the corporate system 1.

  FIG. 4 shows a system outline of the ISP system 31. The ISP system 31 includes a change management device 300, a DHCP (Dynamic Host Configuration Protocol) server 310, and a subscriber management device 320. The change management device 300, the DHCP server 310, and the subscriber management device 320 are connected by a LAN or the like. The system outline of ISP systems other than the ISP system 31 is the same as the system outline of the ISP system 31.

  The DHCP server 310 executes processing for assigning an IP address to a subscriber terminal (for example, a personal computer or a smartphone) in response to a request from the subscriber terminal. The subscriber management device 320 manages information related to the subscriber such as an IP address assigned to the subscriber's terminal and a subscriber ID (Identifier). The change management device 300 performs processing for managing the IP address of the attacker terminal 7.

  FIG. 5 shows a functional block diagram of the change control device 10. The change control device 10 includes a processing unit 100, an ISP specifying unit 101, a change processing unit 102, an attack table storage unit 103, and an ISP table storage unit 104. The processing unit 100 includes a registration processing unit 1001, a notification unit 1002, and a deletion processing unit 1003.

  The registration processing unit 1001 performs processing for registering information on the attacker terminal 7 in the attack table storage unit 103, processing for registering information on the ISP system assigned an IP address to the attacker terminal 7 in the ISP table storage unit 104, and access. Processing for restricting access from the attacker terminal 7 to the control device 11 is performed. The notification unit 1002 notifies the change management device 300 when the information on the attacker terminal 7 is registered. The deletion processing unit 1003 performs processing for deleting information on the attacker terminal 7 from the attack table storage unit 103 and processing for causing the access control device 11 to release the restriction on access from the attacker terminal 7. The ISP identifying unit 101 uses the ISP system ID assigned to the attacker terminal 7 and the IP address of the ISP system (in this embodiment, the IP address of the change management device 300) as the ISP. Obtained from the specific system 5. The change processing unit 102 performs processing for changing information registered for the attacker terminal 7 and processing for causing the access control device 11 to change information of the attacker terminal 7.

  FIG. 6 shows a functional block diagram of the change management apparatus 300. The change management device 300 includes a registration processing unit 3001, a deletion processing unit 3002, a change processing unit 3003, and an attack source IP table storage unit 3004.

  The registration processing unit 3001 performs processing for registering information on the attacker terminal 7 in the attack source IP table storage unit 3004. The deletion processing unit 3002 performs processing for deleting information on the attacker terminal 7 from the attack source IP table storage unit 3004. The change processing unit 3003 performs processing for changing the information of the attacker terminal 7 stored in the attack source IP table storage unit 3004.

  FIG. 7 shows an example of an attack table stored in the attack table storage unit 103. In the example of FIG. 7, the attack source IP address (that is, the source IP address of the packet transmitted from the attacker terminal 7), the attack destination IP address (for example, the IP address of the public server 13), and the entry are updated. The update time, which is the time, and the ISP system ID are stored.

  FIG. 8 shows an example of the ISP table stored in the ISP table storage unit 104. In the example of FIG. 8, the ISP system ID and the IP address of the ISP system are stored.

  FIG. 9 shows an example of data managed by the access control device 11. In the example of FIG. 9, a list of source IP addresses of packets whose access is restricted is managed. Note that the access control apparatus 11 may further manage a list of transmission source IP addresses of packets that are permitted to be accessed.

  FIG. 10 shows an example of the attack source IP table stored in the attack source IP table storage unit 3004. In the example of FIG. 10, the attack source IP address, the subscriber ID, and the company IP address (in this embodiment, the IP address of the change control device 10 in the company system 1) are stored.

  FIG. 11 shows an example of data managed by the subscriber management device 320. In the example of FIG. 11, the subscriber ID and the IP address assigned to the subscriber's terminal are stored.

  FIG. 12 shows an example of data managed by the ISP identification system 5. In the example of FIG. 12, information indicating the address range managed by the ISP system, the ID of the ISP system, and the IP address of the ISP system are stored. An entry is not registered for an ISP system in which the mechanism of this embodiment is not introduced.

  The outline of the present embodiment will be described with reference to FIG. In the present embodiment, the change control device 10 is provided on the company side, and the change management device 300 is provided on the ISP side. Information on the attacker terminal 7 is transmitted between the company side and the ISP side by communication of these devices. Shared on. When the ISP system (in this case, the ISP system 31) that assigns an IP address to the attacker terminal 7 is specified by the change control device 10 and the ISP specifying system 5 of the enterprise system 1, the enterprise system 1 The IP address of the attacker terminal 7 is notified. When the IP address of the attacker terminal 7 is changed, the changed IP address is notified from the ISP system 31 to the enterprise system 1. The change control device 10 in the enterprise system 1 can block attacks by following the change of the IP address by restricting access from the terminal having the changed IP address to the access control device 11.

  Next, the operation of the apparatus in this embodiment will be described with reference to FIGS.

  First, a process executed by the change control device 10 when an attack packet is detected will be described with reference to FIGS. 14 to 16. When an attack packet is detected by the security device 12, the registration processing unit 1001 in the change control device 10 receives input of the attack source IP address, update time, and attack destination IP address from the administrator of the enterprise system 1 (FIG. 14: Step S1).

  The registration processing unit 1001 transmits a registration request including the attack source IP address received in step S1 to the access control apparatus 11 (step S3). Processing executed by the access control apparatus 11 that has received the registration request will be described later.

  The registration processing unit 1001 transmits an ISP system ID and IP address acquisition request for assigning the attack source IP address to the attacker terminal 7 to the ISP specifying system 5 (step S5). For example, as shown in FIG. 15, it is assumed that the ISP system 31 and the ISP system 33 are registered in the data managed by the ISP specifying system 5, but the ISP system 32 is not registered. In such a case, if the attacker terminal 7 is connected to the ISP system 31 or the ISP system 33, the ISP identification system 5 can identify the ISP system to which the attacker terminal 7 is assigned the attack source IP address. If the attacker terminal 7 is connected to the ISP system 32, the ISP identification system 5 cannot identify the ISP system to which the attacker terminal 7 has been assigned an attack source IP address.

  The registration processing unit 1001 determines whether the ISP system to which the attack source IP address has been assigned has been identified (step S7). When the ISP system can be specified, the response to the acquisition request includes the ID of the ISP system to which the attack source IP address is assigned and the IP address of the ISP system. If the ISP system cannot be specified, a response indicating that the ISP system cannot be specified is returned as a response to the acquisition request, or no response is returned.

  When the ISP system to which the attack source IP address is assigned cannot be identified (step S7: No route), the registration processing unit 1001 displays the attack source IP address, the update time, and the attack destination IP address in the attack table storage unit 103. Register in the table (step S9). Then, the process ends.

  On the other hand, when the ISP system (ISP system 31 in the present embodiment) to which the attack source IP address is assigned can be identified (step S7: Yes route), the registration processing unit 1001 displays the attack source IP address, The update time, the attack destination IP address, and the ID included in the response to the acquisition request are registered in the attack table in the attack table storage unit 103 (step S11).

  FIG. 16 shows an example of the attack table after the process of step S11. When the attack table of FIG. 7 is compared with the attack table of FIG. 16, an entry surrounded by a thick solid line is newly added.

  The registration processing unit 1001 determines whether an entry for the ISP system 31 to which the attack source IP address is assigned is registered in the ISP table in the ISP table storage unit 104 (step S13). If an entry for the ISP system 31 to which the attack source IP address has been assigned is registered in the ISP table in the ISP table storage unit 104 (step S13: Yes route), it is not necessary to perform additional registration. Transition to processing.

  On the other hand, if the entry for the ISP system 31 to which the attack source IP address is assigned is not registered in the ISP table in the ISP table storage unit 104 (step S13: No route), the ID of the ISP system 31 to which the attack source IP address is assigned. And the IP address are registered in the ISP table in the ISP table storage unit 104 (step S15).

  The notification unit 1002 transmits the attack source IP address, the update time, and the company IP address (here, the IP address of the change control device 10) to the change management device 300 of the ISP system 31 to which the attack source IP address is assigned ( Step S17). The transmission destination IP address in step S17 is an IP address included in the response to the acquisition request. Then, the process ends. Processing executed by the change management device 300 of the ISP system 31 that has received the attack source IP address, update time, and company IP address will be described later.

  By executing the processing as described above, the IP address of the attacker terminal 7 can be provided not only on the company side but also on the ISP side. Further, the access control device 11 can block attack packets from the attacker terminal 7.

  Next, a process executed when the change management apparatus 300 of the ISP system 31 to which the attack source IP address is assigned receives the attack source IP address, the update time, and the company IP address will be described with reference to FIGS. 17 and 18. .

  First, the registration processing unit 3001 of the change management apparatus 300 in the ISP system 31 to which the attack source IP address is assigned receives the attack source IP address, the update time, and the company IP address from the change control apparatus 10 of the company system 1. Then, the registration processing unit 3001 notifies the attack source IP address and the update time to the subscriber management apparatus 320 (FIG. 17: step S21).

  The subscriber management device 320 that has received the attack source IP address and the update time specifies the subscriber ID corresponding to the received attack source IP address and changes the specified subscriber ID using the data shown in FIG. It transmits to the management apparatus 300. In response to this, the registration processing unit 3001 of the change management device 300 receives the subscriber ID from the subscriber management device 320 (step S23).

  Then, the registration processing unit 3001 registers an entry including the subscriber ID received in step S23 and the received attack source IP address and company IP address in the attack source IP table in the attack source IP table storage unit 3004 (step S25). Then, the process ends.

  When the processing as described above is executed, data as shown in FIG. 18 is stored in the attack source IP table in the attack source IP table storage unit 3004. Comparing the attack source IP table of FIG. 18 with the attack source IP table of FIG. 10, an entry surrounded by a thick solid line is newly added.

  Next, processing executed when the IP address assigned to the attacker terminal 7 is changed will be described with reference to FIGS.

  The DHCP server 310 in the ISP system 31 that has assigned an IP address to the attacker terminal 7 assigns the changed IP address (hereinafter referred to as a new IP address) to the attacker terminal 7 (FIG. 19: step S31).

  The DHCP server 310 transmits allocation information including the new IP address and the IP address before the change (hereinafter referred to as the old IP address) to the subscriber management apparatus 320 (step S33).

  The subscriber management device 320 receives assignment information including the new IP address and the old IP address from the DHCP server 310 (step S35).

  The subscriber management device 320 specifies the subscriber ID corresponding to the old IP address included in the allocation information using the data shown in FIG. Then, the subscriber management device 320 transmits the specified subscriber ID and new IP address to the change management device 300 (step S37).

  The change processing unit 3003 of the change management device 300 receives the subscriber ID and the new IP address from the subscriber management device 320 (step S39).

  The change processing unit 3003 stores the attack source IP address (this IP address corresponds to the old IP address) associated with the subscriber ID received in step S39, stored in the attack source IP table, in step S39. Update with the new IP address received in step S41.

  FIG. 20 shows an example of the attack source IP table when the process of step S41 is executed. When the attack source IP table shown in FIG. 20 is compared with the attack source IP table shown in FIG. 18, the attack source IP address in the entry on the third row is changed from “156.123.56.78” to “156.123”. .56.102 ".

  The change processing unit 3003 transmits the new IP address and the old IP address to the corporate system 1 (step S43). The transmission destination IP address in step S43 is a company IP address included in the updated entry in the attack source IP table in the attack source IP table storage unit 3004.

  The change processing unit 102 in the change control device 10 of the enterprise system 1 receives the new IP address and the old IP address from the change management device 300 in the ISP system 31 that has assigned an IP address to the attacker terminal 7 (step S45).

  The change processing unit 102 updates the same IP address stored in the attack table in the attack table storage unit 103 as the received old IP address with the new IP address received in step S45. Then, the change processing unit 102 updates the corresponding update time with, for example, the current time acquired from the OS (Operating System) system clock (step S47).

  FIG. 21 shows an example of the attack table when the process of step S47 is executed. When the attack table shown in FIG. 16 and the attack table shown in FIG. 21 are compared, the attack source IP address in the entry on the third line is from “156.123.56.78” to “156.1233.56.12. ”And the update time is updated.

  The change processing unit 102 transmits an update request including the old IP address and the new IP address to the access control apparatus 11 (step S49). Processing executed by the access control apparatus 11 that has received the update request will be described later.

  By executing the processing as described above, the IP address set in the access control device 11 can be changed from the old IP address to the new IP address in accordance with the change of the IP address assigned to the attacker terminal 7. .

  Next, a process executed by the change control device 10 when deleting information on the attacker terminal 7 will be described with reference to FIGS. 22 and 23.

  The deletion processing unit 1003 in the change control device 10 receives an input of a deletion instruction (including the attack source IP address here) for deleting information on the attacker terminal 7 from the administrator of the enterprise system 1 or a predetermined It is detected that the condition is satisfied (FIG. 22: Step S51). The predetermined condition is, for example, a condition that there has been no attack from the attacker terminal 7 for a predetermined period.

  The deletion processing unit 1003 deletes the entry including the attack source IP address included in the delete instruction or the attack source IP address satisfying a predetermined condition from the attack table in the attack table storage unit 103 (step S53). Here, when the ID of the ISP system 31 is included in the entry to be deleted, only the ID of the ISP system 31 is saved in a storage device such as a main memory.

  FIG. 23 shows an example of the attack table when the process of step S53 is performed. When the attack table shown in FIG. 23 is compared with the attack table shown in FIG. 21, the entry in the fifth row is deleted.

  The deletion processing unit 1003 transmits a deletion request including the attack source IP address included in the deletion instruction or the attack source IP address satisfying a predetermined condition to the access control apparatus 11 (step S55). Processing executed by the access control apparatus 11 that has received the deletion request will be described later.

  The deletion processing unit 1003 determines whether the ID of the ISP system 31 is included in the entry deleted in step S53 (step S57). If the entry to be deleted in step S53 does not include the ISP system 31 ID (step S57: No route), the process ends.

  On the other hand, if the ID of the ISP system 31 is included in the entry deleted in step S53 (step S57: Yes route), the deletion processing unit 1003 sets the IP address corresponding to the ID of the saved ISP system 31 to the ISP. It is specified from the ISP table in the table storage unit 104 (step S59).

  The deletion processing unit 1003 sends a delete request including the attack source IP address included in the delete instruction to the IP address specified in step S59 (that is, the ISP system 31 to which the attack source IP address included in the delete instruction is assigned). (Step S61). Then, the process ends.

  If the above processing is executed, the entry of the IP address that is not related to the attack is deleted. Therefore, when the IP address is assigned to a non-malicious terminal next time, access from that terminal is restricted. Can be prevented.

  Next, a process executed by the change management apparatus 300 when deleting information on the attacker terminal 7 will be described with reference to FIGS. 24 and 25.

  First, the deletion processing unit 3002 in the change management device 300 of the ISP system 31 that has assigned an IP address to the attacker terminal 7 receives a request to delete the attack source IP address from the enterprise system 1 (FIG. 24: step S71).

  The deletion processing unit 3002 identifies an entry including the attack source IP address included in the deletion instruction in the attack source IP table in the attack source IP table storage unit 3004, and identifies the identified entry in the attack source IP table storage unit 3004. Delete from the table (step S73). Then, the process ends.

  FIG. 25 shows an example of the attack source IP table when the process of step S73 is performed. When the attack source IP table shown in FIG. 20 is compared with the attack source IP table shown in FIG. 25, the entry in the fifth line is deleted.

  If the processing as described above is executed, the entry of the IP address not related to the attack is deleted not only on the company side but also on the ISP side.

  Next, processing executed by the access control apparatus 11 when data is received from the change control apparatus 10 will be described with reference to FIG.

  First, the access control device 11 determines whether the received data is a registration request (FIG. 26: Step S81). When the received data is a registration request (step S81: Yes route), the access control apparatus 11 registers the attack source IP address included in the registration request in the list shown in FIG. 9 (step S83). Then, the process ends.

  On the other hand, when the received data is not a registration request (step S81: No route), the access control apparatus 11 determines whether the received data is an update request (step S85).

  When the received data is an update request (step S85: Yes route), the access control apparatus 11 updates the old IP address included in the list shown in FIG. 9 with the new IP address included in the update request (step S85). S87). Then, the process ends. On the other hand, when the received data is not an update request (step S85: No route), the received data is a deletion request. Therefore, the access control device 11 deletes the attack source IP address included in the deletion request from the list shown in FIG. 9 (step S89). Then, the process ends.

  If the processing as described above is executed, the setting is dynamically changed in response to a request from the change control device 10, so that appropriate access restriction can be performed.

  Although one embodiment of the present invention has been described above, the present invention is not limited to this. For example, the functional block configurations of the change control device 10 and the change management device 300 described above may not match the actual program module configuration.

  Further, the configuration of each table described above is an example, and the configuration as described above is not necessarily required. Further, in the processing flow, the processing order can be changed if the processing result does not change. Further, it may be executed in parallel.

  Note that the change control device 10, the access control device 11, the security device 12, the public server 13, the DHCP server 310, the subscriber management device 320, and the change management device 300 described above are computer devices and are shown in FIG. As described above, a memory 2501, a CPU (Central Processing Unit) 2503, a hard disk drive (HDD: Hard Disk Drive) 2505, a display control unit 2507 connected to the display device 2509, a drive device 2513 for the removable disk 2511, and an input device 2525 and a communication control unit 2517 for connecting to a network are connected by a bus 2519. An operating system (OS) and an application program for executing the processing in this embodiment are stored in the HDD 2505, and are read from the HDD 2505 to the memory 2501 when executed by the CPU 2503. The CPU 2503 controls the display control unit 2507, the communication control unit 2517, and the drive device 2513 according to the processing content of the application program, and performs a predetermined operation. Further, data in the middle of processing is mainly stored in the memory 2501, but may be stored in the HDD 2505. In the embodiment of the present invention, an application program for performing the above-described processing is stored in a computer-readable removable disk 2511 and distributed, and installed in the HDD 2505 from the drive device 2513. In some cases, the HDD 2505 may be installed via a network such as the Internet and the communication control unit 2517. Such a computer apparatus realizes various functions as described above by organically cooperating hardware such as the CPU 2503 and the memory 2501 described above and programs such as the OS and application programs. .

  The embodiment of the present invention described above is summarized as follows.

  The access restriction management apparatus according to the first aspect of the present embodiment transmits (A) a first transmission source address included in a received packet to an access control apparatus that performs access restriction based on the transmission source address. The first change management device is identified based on the first source address from one communication unit (for example, the registration processing unit 1001) and (B) a plurality of change management devices each managing a change in address assignment. A specifying unit (for example, ISP specifying unit 101), (C) a second communication unit (for example, notifying unit 1002) that transmits a first transmission source address to the first change management device specified by the specifying unit, and ( D) From the first change management device that detects that the address assigned to the transmission source of the packet has been changed from the first transmission source address to the second transmission source address, Receiving a scan, and a third communication unit for transmitting the second address received in the access control device (e.g., change processing unit 102).

  By executing such processing, it is possible to continue the access restriction based on the source address even when the source address of the packet is changed.

  In addition, the access restriction management device (E) when the predetermined condition is satisfied for the first transmission source address or when an instruction for deleting the first transmission source address is received, the first transmission source You may further have the 4th communication part (for example, deletion process part 1003) which transmits the deletion request | requirement for deleting an address to an access control apparatus. It becomes possible to prevent restricting access from a specific source address.

  The identification unit transmits the first transmission source address to the identification device that performs processing of identifying the change management device to which the transmission source address is assigned from a plurality of change management devices, and (b2) the identification device. May receive the address of the first change management device. And the said 2nd communication part may transmit a 1st transmission source address to a 1st change management apparatus using the address of (c1) 1st change management apparatus. The change management device can be easily identified.

  Each of the plurality of change management devices may be included in a system of one Internet service provider.

  The packet may be a packet of denial of service attack.

  In the access restriction management method according to the second aspect of the present embodiment, (F) the first transmission source address included in the received packet is transmitted to the access control apparatus that performs access restriction based on the transmission source address, (G) A first change management device is identified based on a first source address from a plurality of change management devices, each managing a change in address assignment, and (H) the identified first change management A first transmission source address is transmitted to the device, and (I) a first detected that the address assigned to the transmission source of the packet has been changed from the first transmission source address to the second transmission source address Receiving the second transmission source address from the change management apparatus, and (J) transmitting the received second address to the access control apparatus.

  A program for causing a computer to execute the processing according to the above method can be created. The program can be a computer-readable storage medium such as a flexible disk, CD-ROM, magneto-optical disk, semiconductor memory, or hard disk It is stored in a storage device. The intermediate processing result is temporarily stored in a storage device such as a main memory.

  The following supplementary notes are further disclosed with respect to the embodiments including the above examples.

(Appendix 1)
A first communication unit that transmits a first transmission source address included in the received packet to an access control device that performs access restriction based on the transmission source address;
A specifying unit for specifying a first change management device based on the first transmission source address from a plurality of change management devices each managing a change in address assignment;
A second communication unit that transmits the first source address to the first change management device identified by the identifying unit;
From the first change management device that has detected that the address assigned to the source of the packet has been changed from the first source address to the second source address, the second source address And a third communication unit that transmits the received second address to the access control device;
An access restriction management device.

(Appendix 2)
When a predetermined condition is satisfied for the first transmission source address or when an instruction for deleting the first transmission source address is received, a deletion request for deleting the first transmission source address is issued. The access restriction management device according to appendix 1, further comprising: a fourth communication unit that transmits to the access control device.

(Appendix 3)
The specific part is:
Transmitting the first source address to a specific device that performs processing for specifying the change management device to which the source address is assigned from the plurality of change management devices;
Receiving the address of the first change management device from the specific device;
The second communication unit is
Transmitting the first source address to the first change management device using the address of the first change management device;
The access restriction management device according to appendix 1 or 2.

(Appendix 4)
Each of the plurality of change management devices is included in a system of one Internet service provider.
The access restriction management device according to any one of appendices 1 to 3.

(Appendix 5)
The packet is a packet of denial of service attack;
The access restriction management device according to any one of appendices 1 to 4.

(Appendix 6)
Computer
A first transmission source address included in the received packet is transmitted to an access control device that performs access restriction based on the transmission source address;
Identifying a first change management device based on the first source address from a plurality of change management devices each managing a change in address assignment;
Sending the first source address to the identified first change management device;
From the first change management device that has detected that the address assigned to the source of the packet has been changed from the first source address to the second source address, the second source address Receive
Transmitting the received second address to the access control device;
An access restriction management method for executing processing.

(Appendix 7)
On the computer,
A first transmission source address included in the received packet is transmitted to an access control device that performs access restriction based on the transmission source address;
Identifying a first change management device based on the first source address from a plurality of change management devices each managing a change in address assignment;
Sending the first source address to the identified first change management device;
From the first change management device that has detected that the address assigned to the source of the packet has been changed from the first source address to the second source address, the second source address Receive
Transmitting the received second address to the access control device;
Access restriction management program that executes processing.

(Appendix 8)
An access restriction management device for managing access restrictions;
A plurality of change management devices each managing a change in address assignment;
An access control device that restricts access based on a source address;
Have
The access restriction management device includes:
A first communication unit that transmits a first source address included in the received packet to the access control device;
A specifying unit for specifying a first change management device based on the first transmission source address from the plurality of change management devices;
A second communication unit that transmits the first source address to the first change management device identified by the identifying unit;
From the first change management device that has detected that the address assigned to the source of the packet has been changed from the first source address to the second source address, the second source address And a third communication unit that transmits the received second address to the access control device;
An information processing system having

DESCRIPTION OF SYMBOLS 1 Corporate system 31,32,33 ISP system 5 ISP specific system 7 Attacker terminal 9 Internet 10 Change control apparatus 11 Access control apparatus 12 Security apparatus 13 Public server 300 Change management apparatus 310 DHCP server 320 Subscriber management apparatus 100 Processing part 101 ISP specifying unit 102 change processing unit 103 attack table storage unit 104 ISP table storage unit 1001 registration processing unit 1002 notification unit 1003 deletion processing unit 3001 registration processing unit 3002 deletion processing unit 3003 change processing unit 3004 attack source IP table storage unit

Claims (6)

A first communication unit that transmits a first transmission source address included in the received packet to an access control device that performs access restriction based on the transmission source address;
A specifying unit for specifying a first change management device based on the first transmission source address from a plurality of change management devices each managing a change in address assignment;
A second communication unit that transmits the first source address to the first change management device identified by the identifying unit;
From the first change management device that has detected that the address assigned to the source of the packet has been changed from the first source address to the second source address, the second source address And a third communication unit that transmits the received second address to the access control device;
An access restriction management device. When a predetermined condition is satisfied for the first transmission source address or when an instruction for deleting the first transmission source address is received, a deletion request for deleting the first transmission source address is issued. The access restriction management device according to claim 1, further comprising a fourth communication unit that transmits to the access control device. The specific part is:
Transmitting the first source address to a specific device that performs processing for specifying the change management device to which the source address is assigned from the plurality of change management devices;
Receiving the address of the first change management device from the specific device;
The second communication unit is
Transmitting the first source address to the first change management device using the address of the first change management device;
The access restriction management apparatus according to claim 1 or 2. Computer
A first transmission source address included in the received packet is transmitted to an access control device that performs access restriction based on the transmission source address;
Identifying a first change management device based on the first source address from a plurality of change management devices each managing a change in address assignment;
Sending the first source address to the identified first change management device;
From the first change management device that has detected that the address assigned to the source of the packet has been changed from the first source address to the second source address, the second source address Receive
Transmitting the received second address to the access control device;
An access restriction management method for executing processing. On the computer,
A first transmission source address included in the received packet is transmitted to an access control device that performs access restriction based on the transmission source address;
Identifying a first change management device based on the first source address from a plurality of change management devices each managing a change in address assignment;
Sending the first source address to the identified first change management device;
From the first change management device that has detected that the address assigned to the source of the packet has been changed from the first source address to the second source address, the second source address Receive
Transmitting the received second address to the access control device;
Access restriction management program that executes processing. An access restriction management device for managing access restrictions;
A plurality of change management devices each managing a change in address assignment;
An access control device that restricts access based on a source address;
Have
The access restriction management device includes:
A first communication unit that transmits a first source address included in the received packet to the access control device;
A specifying unit for specifying a first change management device based on the first transmission source address from the plurality of change management devices;
A second communication unit that transmits the first source address to the first change management device identified by the identifying unit;
From the first change management device that has detected that the address assigned to the source of the packet has been changed from the first source address to the second source address, the second source address And a third communication unit that transmits the received second address to the access control device;
An information processing system having

Images