JP4668596B2 - Communication terminal, server device and monitoring system - Google Patents

Description

  The present invention relates to a communication terminal, a server device, and a monitoring system.

  In general, system failures are broadly classified into those caused by external attacks and those caused by internal system factors. Conventionally, the former attack from the outside is often dealt with using anti-virus software or intrusion detection software.

  An apparatus aimed at automating virus countermeasure processing has been disclosed (for example, see Patent Document 1). Here, a server device that centrally executes virus countermeasure execution instructions and management is prepared, and the server device transmits antivirus software to each client, executes instructions, and receives and analyzes processing results. Since all processing is performed centrally by the server device, the burden on the client user is reduced.

  In addition, a means for detecting an infection source of a virus by combining an access history with respect to a client computer and anti-virus software is also disclosed (for example, see Patent Document 2).

There is also disclosed a virus check network for the purpose of preventing viruses on the network side by checking virus infection during packet relay using a virus check device on the network (for example, patents). Reference 3).
JP 2002-222094 A JP 2004-86241 A JP-A-11-167487

  In recent years, portable terminals equipped with short-range wireless communication devices have been generally released and have begun to show signs of widespread use, and virus programs that expand using short-range wireless communication have appeared and are becoming a threat that causes system failures. Unlike the conventional virus program, these short-range wireless communication type viruses do not pass through the fixed network, so it is difficult to find and remove the virus with a network relay device.

  It is also possible to prepare anti-virus software for each terminal and detect viruses as in the above-mentioned prior art, but it is difficult to put in high-performance anti-virus software due to the low computing power of mobile terminals. At the same time, there is a problem that the anti-virus software itself cannot be dealt with when it becomes an attack target or when the virus pattern file cannot be updated in time.

  Therefore, in view of the above problems, the present invention provides a communication terminal, a server device, and a monitoring system that can detect a near field communication virus that has been difficult to detect and a system failure caused by the virus. The purpose is to provide.

  In order to achieve the above object, the first feature of the present invention is that (a) a tamper resistant monitoring unit that monitors a state of a corresponding terminal existing in the vicinity using near field communication, and (b) a tamper resistant monitor. A virus detection unit that receives primary monitoring results and detects primary viruses. The tamper resistant monitoring unit provides more detailed virus detection than the virus detection unit when an abnormality is detected by the virus detection unit. The gist is that it is a communication terminal that transmits to the server device to be performed.

  According to the communication terminal according to the first feature, it is possible to detect a near field communication virus that has been difficult to detect and a system failure caused by the virus.

  The communication terminal according to the first feature further includes a tamper resistant detailed information acquiring unit that acquires detailed information of the corresponding terminal or the communication terminal in response to a request from the tamper resistant monitoring unit or the server device. The unit may transmit the detailed information to the server device.

  According to this communication terminal, virus detection can be performed based on more detailed information.

  In the communication terminal according to the first feature, the tamper resistant monitoring unit may monitor the state of the virus detection unit of its own terminal and transmit the monitoring result to the server device.

  According to this communication terminal, the robustness of the virus detection unit can be improved by regular monitoring of the terminal itself and detection by the server device.

  The second feature of the present invention is based on the monitoring result received from the communication terminal that monitors the state of the corresponding terminal in the vicinity using short-range wireless communication and performs primary virus detection based on the monitoring result. The gist of the invention is that the server device includes a virus detection unit that performs more detailed virus detection than the virus detection unit.

  According to the server device according to the second feature, it is possible to discover a near field communication virus that has been difficult to detect and a system failure caused by the virus.

  In the server device according to the second feature, the virus detection unit may set the importance based on the virus detection capability of the communication terminal included in the monitoring result, and perform processing according to the importance. .

  The server device according to the second feature further includes a terminal group management unit that manages the communication terminals by dividing them into a plurality of groups according to the virus detection capability of the communication terminals, and the virus detection unit corresponds to the group. May be performed.

  A third feature of the present invention is that (a) a communication terminal that monitors the state of a corresponding terminal existing in the vicinity using short-range wireless communication and performs primary virus detection based on the monitoring result; and (b) When the abnormality is detected by the communication terminal, the gist of the present invention is a monitoring system including a server device that receives the monitoring result from the communication terminal and performs detailed virus detection from the virus detection unit.

  According to the monitoring system according to the third feature, it is possible to detect a near field communication virus that has been difficult to detect and a system failure caused by the virus.

  According to the present invention, it is possible to provide a communication terminal, a server device, and a monitoring system that can detect a near field communication virus that has been difficult to detect and a system failure caused by the virus.

  Next, embodiments of the present invention will be described with reference to the drawings. In the following description of the drawings, the same or similar parts are denoted by the same or similar reference numerals. However, it should be noted that the drawings are schematic.

(Monitoring system)
As shown in FIG. 1, the monitoring system according to the embodiment of the present invention includes a plurality of communication terminals 10 and 20 and a server device 30. The communication terminals 10 and 20 communicate with each other by short-range wireless communication, and the communication terminal and the server device 30 perform normal wireless communication.

  In the following description, the communication terminal to be monitored is referred to as the corresponding terminal 10, and the monitoring terminal is referred to as the monitoring terminal 20. A terminal existing around the terminal is called a peripheral terminal.

  As shown in FIG. 2, each communication terminal includes virus detection units 101 and 201, tamper resistant monitoring units 102 and 202, and tamper resistant detailed information acquisition units 103 and 203. The configuration of the communication terminal is the same for both the corresponding terminal 10 and the monitoring terminal 20.

  The tamper resistant monitoring unit 202 of the monitoring terminal 20 monitors peripheral terminals using short-range wireless communication such as wireless LAN or Bluetooth. Specifically, the tamper resistant monitoring unit 202 acquires information on the network state between the peripheral communication terminals and the peripheral communication terminals from the tamper resistant detailed information acquisition unit 103 of the corresponding terminal 10, etc. Monitor regularly. In addition, the tamper resistant monitoring unit 202 transmits the monitoring result of the corresponding terminal 10 to the virus detection unit 201.

  The virus detection unit 201 receives the monitoring result from the tamper resistant monitoring unit 202 and performs primary virus detection. Here, if no virus is found in particular, the tamper resistant monitoring unit 202 continues to monitor peripheral terminals.

  On the other hand, when a virus is found, the tamper resistant monitoring unit 202 acquires information such as the virus detection capability, position information, and time information of the monitoring terminal 20 from the tamper resistant detailed information acquiring unit 203 in the monitoring terminal 20. The result is added to the monitoring result and transmitted to the server device 30.

  Here, the “virus detection capability” includes, for example, the presence or absence of a virus detection program and the update status of the pattern file (pattern file version, date, etc. In addition, depending on the application installed in the terminal, there is a vulnerability. Since the number of applications may increase, a list of installed application names can also be listed.

  In addition, the “monitoring result” includes binary values indicating whether or not a virus was found as a result of monitoring, and information such as the virus name and damage status (how many files were infected, etc.) if found. Is included.

  As shown in FIG. 2, the server device 30 includes a virus detection unit 301 and a terminal group management unit 302.

  The virus detection unit 301 performs more detailed virus detection based on the monitoring result received from the monitoring terminal 20. The virus detection unit 301 on the server device 30 has abundant calculation capability and is considered to have the latest pattern file. Therefore, it is possible to detect a virus with more detail and less errors.

  In addition, when there are a plurality of peripheral monitoring terminals 20, the virus detection unit 301 may have a difference in virus detection capability. Therefore, it is important to compare the virus detection capability among a plurality of terminals and respond accordingly. You may set the degree. For example, a high importance level is set for “notification from a terminal having excellent detection capability” and “when the monitoring result is serious”. Depending on the importance, processing such as selection, acquisition of detailed information, and increase of processing priority may be performed.

  Further, the virus detection unit 301 may collect the monitoring results for the same target observed at the same time using the received position information and time information as a key, and avoid double processing. According to this configuration, it is possible to perform virus detection processing with higher accuracy and less load.

  Further, when the virus detection unit 301 on the server device 30 requests detailed information of the corresponding terminal 10, the virus detection unit 301 inquires the tamper resistant detailed information acquisition unit 103 of the corresponding terminal 10 to acquire the detailed information of the corresponding terminal 10. And check the infection status of the virus.

  In addition, the terminal group management unit 302 manages the terminals by dividing them into a plurality of groups in order to optimize the virus detection processing according to the virus detection capability of the terminals. Since only the virus detection at the terminal side is sufficient, it is possible to manage the terminals separately into groups that do not require virus detection at the server device 30 or groups that require detailed detection using the terminal detailed information. Virus detection processing adapted to each terminal can be performed.

  For example, the terminal group management unit 302 can manage the communication terminals by dividing them into the following three groups.

(1) A terminal that is monitored from a peripheral terminal and only receives an abnormality notification from the server (2) A terminal that is monitored from the peripheral terminal, performs a detailed virus check at the server, and receives a notification (3) A server that is monitored from the peripheral terminal The terminal group management unit 302 links the terminal IDs to these group IDs and manages them.

  The grouping described above is performed in response to a user request and does not depend on functions on the terminal. For example, if the user requests, the server apparatus 30 manages until patch transmission.

  Further, the monitoring system according to the present embodiment may monitor not only the peripheral terminals but also the own terminal.

  Virus detection units 101 and 201 on the communication terminal are prepared in a normal memory space because the pattern file is frequently updated. On the other hand, since the tamper resistant monitoring units 102 and 202 are mounted as tamper resistant hardware, they are not easily tampered with. Therefore, in order to protect the virus detection units 101 and 102 and the normal memory space that may be attacked by viruses, the inside of the own terminal may be periodically monitored.

  In this case, the tamper resistant monitoring units 102 and 202 periodically monitor the virus detection units 101 and 201 of the own terminal and the normal memory space so as to be performed on the peripheral terminals. Similarly, the virus detection capability, location information, and time information of the own terminal are added to the obtained monitoring result. However, since the virus detection units 101 and 201 of the own terminal may be under attack, primary virus detection is performed. The monitoring result is transmitted to the virus detection unit 301 of the server device 30 as it is.

  The virus detection unit 301 of the server device 30 performs virus detection, acquires detailed information from the tamper resistant detailed information acquisition units 103 and 203 of the terminal as necessary, and performs detailed detection.

  Further, the communication terminals 10 and 20 according to the present embodiment have a processing control device (CPU), and the virus detection units 101 and 201, the tamper resistant monitoring units 102 and 202, and the tamper resistant detailed information acquisition units 103 and 203 described above. Etc. can be configured to be executed by the CPU as modules. These modules can be realized by executing a dedicated program for using a predetermined program language in a general-purpose computer such as a personal computer.

  Although not shown, the communication terminals 10 and 20 may include a program holding unit that stores a program for causing the CPU to execute virus detection processing, tamper resistance monitoring processing, tamper resistance detailed information acquisition processing, and the like. . The program holding unit is a recording medium such as a RAM, a ROM, a hard disk, a flexible disk, a compact disk, an IC chip, and a cassette tape. According to such a recording medium, it is possible to easily store, transport, and sell programs.

  Similarly, the server device 30 includes a processing control device (CPU), and can be configured to be executed by the CPU with the above-described virus detection unit 301, terminal group management unit 302, and the like as modules. These modules can be realized by executing a dedicated program for using a predetermined program language in a general-purpose computer such as a personal computer.

  Although not shown, the server device 30 may include a program holding unit that stores a program for causing the CPU to execute virus detection processing, terminal group management processing, and the like. The program holding unit is a recording medium such as a RAM, a ROM, a hard disk, a flexible disk, a compact disk, an IC chip, and a cassette tape. According to such a recording medium, it is possible to easily store, transport, and sell programs.

(Monitoring method)
Next, the monitoring method according to the present embodiment will be described with reference to FIGS. 1 and 2 and FIG. FIG. 3 illustrates a case where the monitoring terminal 20 monitors the corresponding terminal 10 existing in the vicinity.

  4 is a flowchart showing the operation of the monitoring terminal 20, FIG. 5 is a flowchart showing the operation of the server device 30, and FIG. 6 is a flowchart showing the operation of the terminal 10.

  First, in step S101, the tamper resistance monitoring unit 202 of the monitoring terminal 20 periodically monitors the corresponding terminal 10 using short-range wireless communication (step S11 in FIG. 4). At this time, detailed terminal information may be acquired by performing communication with the corresponding terminal 10 or communicating with the tamper resistant monitoring unit 102 or the tamper resistant detailed information acquiring unit 103 of the corresponding terminal.

  Next, in step S102, the tamper resistant monitoring unit 202 transmits the obtained monitoring result to the virus detection unit 201.

  Next, in step S103, the virus detection unit 201 detects an abnormality such as a virus infection state or a malfunction of the corresponding terminal 10 with its own virus detection function (step S12 in FIG. 4).

  If an abnormality is found, a monitoring result transmission request is transmitted to the tamper resistant monitoring unit 202 in step S104. In step S105, the tamper resistant monitoring unit 202 acquires additional information such as the virus detection capability and position information and time information of the monitoring terminal 20 from the tamper resistant detailed information acquiring unit 203 (step S13 in FIG. 4), and step S106. The monitoring result with additional information is transmitted to the server device 30 (step S14 in FIG. 4).

  Next, in step S107, the virus detection unit 301 of the server device 30 receives the monitoring result (step S21 in FIG. 5) and compares the virus detection capability of the monitoring terminal 20 with the monitoring result to determine the importance ( Step S22 in FIG. In the case of an important abnormality, in order to acquire detailed information, in step S108, the tamper resistant detailed information acquiring unit 103 of the terminal 10 is requested to transmit detailed information.

  Next, in step S109, the tamper resistant detailed information acquisition unit 103 of the terminal 10 receives the detailed information transmission request (step S31 in FIG. 6), and acquires detailed information about the own terminal such as its own memory dump. (Step S32 in FIG. 6). In step S110, the detailed information is transmitted to the virus detection unit 301 (step S33 in FIG. 6).

  Next, in step S111, the virus detection unit 301 acquires detailed information (step S23 in FIG. 5), and performs detailed abnormality detection (for example, secondary virus detection) based on the detailed information (in FIG. 5). Step S24). If the content of the abnormality is found, in step S112, some measures are taken for the corresponding terminal 10 (step S25 in FIG. 5).

  Next, a method for the monitoring terminal 20 to monitor its own terminal will be described with reference to FIGS. 1 and 2 and FIG.

  First, in step S201, the tamper resistance monitoring unit 202 periodically monitors its own virus detection unit 201 and memory space.

  Next, in step S202, the tamper resistant detailed information acquisition unit 203 acquires the virus detection capability, position information, and time information of the monitoring terminal 20 from the obtained monitoring data. In step S203, the tamper resistant monitoring unit 202 The monitoring result with additional information is transmitted to the virus detection unit 301 of the server device 30.

  Next, in step S204, the virus detection unit 301 of the server device 30 performs abnormality detection using the obtained monitoring data, and if necessary, from the tamper resistance detailed information acquisition unit 203 of the monitoring terminal 20 in step S205. Get detailed information.

  In step S <b> 206, when an abnormality is found in the monitoring terminal 20, the virus detection unit 301 of the server device 30 performs some measures on the monitoring terminal 20.

  Further, the terminal group management unit 302 of the server device 30 manages each terminal by dividing it into a plurality of groups. By grouping in advance according to the function of the terminal, it becomes possible to optimize the virus detection processing. For example, an inquiry is made to the terminal group management unit 302 when determining whether or not the virus detection unit 301 should detect a virus and whether or not detailed information should be acquired from the tamper resistant detailed information acquisition unit 103. A process such as selecting a process is conceivable.

(Action and effect)
According to the monitoring system and the monitoring method according to the present embodiment, by combining the monitoring means by the peripheral monitoring terminal 20 having the tamper resistant monitoring unit 202 and the server device 30 having the virus detecting unit 301, the virus in the terminal is combined. It is possible to cope with a case where the detection unit 101 is attacked, and at the same time, it is possible to find and remove a virus propagating through short-range wireless communication and a system failure caused by the virus without using a network device.

  Further, since the virus detection unit 201 of the monitoring terminal 20 performs primary virus detection, it is possible to reduce the load on the server device.

  Furthermore, the reliability of virus detection can be improved by adding virus detection capability and position / time information to the monitoring information.

  Moreover, the robustness of the virus detection unit can be improved by regular monitoring of the terminal itself and detection by the server device. In this way, the tamper-resistant monitoring unit on the terminal side monitors its own terminal, and requests virus detection from the server device's virus detection unit, so that detection and countermeasures can be taken even after a successful attack against anti-virus software. Make it possible.

(Other embodiments)
Although the present invention has been described according to the above-described embodiments, it should not be understood that the descriptions and drawings constituting a part of this disclosure limit the present invention. From this disclosure, various alternative embodiments, examples and operational techniques will be apparent to those skilled in the art.

  For example, although virus detection has been described in the embodiment of the present invention, the present invention may also be used for terminal malfunction and bug detection. By including the memory dump of the corresponding terminal 10 in the monitoring result by the tamper resistant monitoring unit 202 or the detailed information obtained from the tamper resistant detailed information acquiring unit 103, a defect or bug included in the terminal from the beginning, It becomes possible to inspect the application state of patch data and the like, and the threats that cause system failures can be reduced.

  One embodiment of the present invention includes virus detection not only between terminals but also between devices in a personal area network. Not only the terminal but also the peripheral device behaves as the corresponding terminal 10 and the monitoring terminal 20, and performs mutual monitoring. In this model, since each terminal is assumed to be possessed by the same user, there is a possibility that more detailed monitoring can be performed. At that time, as usual, there are a model in which the server device 30 is provided and each peripheral device communicates, and a model in which the peripheral device having the highest calculation capability in the personal area network plays the role of the server device 30. In the latter case, the burden on the peripheral device is small because long-distance communication is not necessary, but there is a problem that the burden is concentrated on the device that plays the role of the server device 30.

  As described above, the present invention naturally includes various embodiments not described herein. Therefore, the technical scope of the present invention is defined only by the invention specifying matters according to the scope of claims reasonable from the above description.

1 is a configuration block diagram of a monitoring system according to the present embodiment. It is a block diagram of the configuration of a communication terminal and a server device according to the present embodiment. It is a sequence diagram of the monitoring method which concerns on this embodiment (the 1). It is a flowchart which shows operation | movement of the monitoring terminal which concerns on this embodiment. It is a flowchart which shows operation | movement of the server apparatus which concerns on this embodiment. It is a flowchart which shows operation | movement of the applicable terminal which concerns on this embodiment. It is a sequence diagram of the monitoring method which concerns on this embodiment (the 2).

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 ... Corresponding terminal 20 ... Monitoring terminal 30 ... Server apparatus 101 ... Virus detection part 102 ... Tamper resistance monitoring part 103 ... Tamper resistance detailed information acquisition part 201 ... Virus detection part 202 ... Tamper resistance monitoring part 203 ... Tamper resistance detailed information acquisition part 301: Virus detection unit 302 ... Terminal group management unit

Claims (7)

A communication terminal that performs wireless communication with a peripheral terminal that exists in the vicinity using short-range wireless communication,
Using said short-range wireless communication, the tamper monitoring unit for monitoring the state of the corresponding terminal on the side to be monitored by the communication terminal a said peripheral device,
A virus detection unit that receives a monitoring result of the corresponding terminal from the tamper resistant monitoring unit and performs primary virus detection of the corresponding terminal ;
The tamper resistant monitoring unit, when a virus is detected by the virus detection unit, transmits the monitoring result to a server device that performs more detailed virus detection than the primary virus detection by the virus detection unit , and the communication terminal The virus detection capability of the server to the server device,
The virus detection capability includes a presence or absence of a virus detection program or an update state of a pattern file . In response to a request from the tamper resistant monitoring unit or the server device, the tamper resistant detailed information acquiring unit that acquires detailed information of the corresponding terminal is further provided.
The communication terminal according to claim 1, wherein the tamper resistant monitoring unit transmits the detailed information to the server device. The communication terminal according to claim 1, wherein the tamper resistant monitoring unit monitors the state of the terminal itself by the virus detection unit and transmits the monitoring result to the server device. A server device that receives a monitoring result of the peripheral terminal from a communication terminal that performs wireless communication with a peripheral terminal that exists in the vicinity using short-range wireless communication ,
The communication terminal uses the short-range wireless communication to monitor the state of the corresponding terminal on the side which is the peripheral terminal and is monitored by the communication terminal, and performs primary virus detection of the corresponding terminal.
A virus detection unit that receives the monitoring result of the corresponding terminal and the virus detection capability of the communication terminal from the communication terminal, and performs virus detection in more detail than the primary virus detection based on the received monitoring result and the virus detection capability A server device comprising: The virus detection unit
Compare the virus detection capabilities of multiple communication terminals, set the importance according to the virus detection capability ,
The server device according to claim 4, wherein processing according to the importance is performed. According to the virus detection capability of the communication terminal, further comprising a terminal group management unit for managing the communication terminal divided into a plurality of groups,
The server device according to claim 4, wherein the virus detection unit performs processing according to the group. A communication terminal that performs wireless communication with a peripheral terminal that exists in the vicinity using short-range wireless communication;
A server device that receives the monitoring result of the peripheral terminal from the communication terminal;
A monitoring system comprising:
The communication terminal is
Using the short-range wireless communication, a tamper-resistant monitoring unit that monitors the state of the corresponding terminal on the side that is the peripheral terminal and is monitored by the communication terminal;
A virus detection unit that receives a monitoring result of the corresponding terminal from the tamper resistant monitoring unit and performs primary virus detection of the corresponding terminal;
The tamper resistant monitoring unit, when a virus is detected by the virus detection unit, transmits the monitoring result to a server device that performs more detailed virus detection than the primary virus detection by the virus detection unit, and the communication terminal The virus detection capability of the server to the server device,
The virus detection capability includes the presence or absence of a virus detection program or the update status of a pattern file,
The server device receives the monitoring result of the corresponding terminal and the virus detection capability of the communication terminal from the communication terminal, and more detailed virus detection than the primary virus detection based on the received monitoring result and the virus detection capability. A monitoring system comprising a virus detection unit for performing

Images