JP6628120B2 - Communication monitoring device and communication monitoring system - Google Patents

Description

  The present invention relates to a communication monitoring device and a communication monitoring system that monitor communication in a network.

  2. Description of the Related Art An energy management system (EMS) that supports energy management in a house or the like by acquiring a power usage status or a power generation status by a control device connected to an air conditioner, lighting, a watt hour meter, or the like is known (Patent Document 1) 1).

  In EMS, devices of various companies are required to communicate using a standardized protocol. However, there is a possibility that the operation of the system may be affected depending on the connected devices. For example, there is a possibility that a computer is connected to the EMS by an unauthorized program created according to a standard protocol, and the EMS is abused.

JP 2013-219848 A

  In order to protect the EMS from unauthorized connection, it is necessary to protect all the devices that make up the EMS. However, all the devices that make up the EMS have the function of detecting and blocking unauthorized communication, and all the devices. It is generally difficult to detect and block unauthorized communications to

  The present invention has been made in view of the above problems, and has as its object to provide a communication monitoring device and a communication monitoring system capable of simply and appropriately restricting unauthorized communication.

In order to achieve the above object, a first aspect of the present invention provides that at least one device and the at least one device are registered by mutual authentication with each of the at least one device. A communication monitoring device communicably connected via a network to one control device constituting a management system that manages each of the one device, wherein the target device is managed from a target device connected to the network. A communication unit that receives a communication start notification including a destination address when starting communication in the system, a storage unit that stores criteria for determining whether or not the device is a legitimate device in the management system, and a communication start received by the communication unit By comparing the notification with the judgment criteria stored in the storage unit, the target device can be identified as a valid device in the management system. A determination unit that determines whether or not the target device is not a legitimate device, and a communication restriction unit that restricts communication of the target device when the determination unit determines that the target device is not a valid device. stored, determination unit, if it is communication start sending notifications sequentially within a predetermined time for different destination address of the communication start notification is the address of the control device apparatus, the target device is judged not to be authorized device The gist is to be a communication monitoring device.

A second aspect of the invention manages each of the at least one device by registering each of the at least one device and each of the at least one device by cross-certifying with each of the at least one device. The gist of the present invention is a communication monitoring system including one control device that constitutes a management system and a communication monitoring device that is communicably connected via a network, wherein the communication monitoring device is a target device connected to the network. A communication unit that receives a communication start notification including a destination address when the target device starts communication in the management system, a storage unit that stores criteria for determining whether the device is a valid device in the management system, and a communication unit that receives the notification. The target device is managed by comparing the notified communication start notification with the judgment criteria stored in the storage unit. A determination unit that determines whether or not the device is a legitimate device in the system, and a communication restriction unit that restricts communication with the target device when the determination unit determines that the target device is not a legitimate device. storing the address of the device, the determination unit, when being communicated starts sending notifications sequentially within a predetermined time for different destination address of the communication start notification is the address of the control device apparatus, the target device is authorized device It is characterized by judging that it is not.

  According to the present invention, it is possible to provide a communication monitoring device and a communication monitoring system capable of easily and appropriately restricting connection by an unauthorized device.

FIG. 1 is a schematic block diagram illustrating a basic configuration of a communication monitoring system according to an embodiment of the present invention. FIG. 1 is a block diagram illustrating a basic configuration of a communication monitoring device included in a communication monitoring system according to an embodiment of the present invention. 3 is an example illustrating registered device information used in the communication monitoring system according to the embodiment of the present invention. It is an example which illustrated network information used for the communication monitoring system according to the embodiment of the present invention. 4 is an example illustrating monitoring information provided in the communication monitoring system according to the embodiment of the present invention. FIG. 4 is a sequence diagram illustrating an operation example of the communication monitoring system according to the embodiment of the present invention. 5 is a flowchart illustrating an operation example of a communication monitoring device included in the communication monitoring system according to the embodiment of the present invention.

  Next, an embodiment of the present invention will be described with reference to the drawings. In the following description of the drawings, the same or similar parts are denoted by the same or similar reference numerals, and redundant description is omitted.

(Communication monitoring system)
As shown in FIG. 1, a communication monitoring system according to an embodiment of the present invention includes a communication monitoring device 1, a control device 2, a plurality of devices 3a to 3c, a communication monitoring device 1, a control device 2, and a plurality of devices. It includes a network N for connecting the devices 3a to 3c so that they can communicate with each other, and a router 6. The router 6 is connected to, for example, a home network N, and relays communication between the control device 2 and the devices 3a to 3c and the Internet 7.

  The control device 2 registers the devices 3a to 3c by mutually authenticating with the devices 3a to 3c. The control device 2 configures the management system M together with the devices 3a to 3c by registering the devices 3a to 3c. The management system M is, for example, a home energy management system (HEMS) in which the control device 2 manages the amount of power used by the devices 3a to 3c, the surplus power generation, and the like.

  The control device 2 is, for example, a controller in the HEMS. In this case, each of the devices 3a to 3c includes, for example, a home electric device such as an air conditioner, a refrigerator, and a lighting device, and a power device such as a solar battery and a storage battery. In addition, the devices 3a to 3c may include a smart meter, an electric vehicle (EV), a plug-in hybrid vehicle (PHV), a water heater, and the like. In the example shown in FIG. 1, the number of devices 3 a to 3 c constituting the control device 2 and the management system M is three, but may be a single number or a plurality other than three.

  The line of the network N may be wireless or wired. The network N appropriately includes a relay device such as a switching hub or an access point. As shown in FIG. 1, the communication monitoring system according to the embodiment of the present invention monitors communication on the network N even when the unauthorized device 4 is Unauthorized communication can be restricted. The network N may be connected to another device 5 such as a personal computer.

  The communication monitoring device 1 includes a computer including a processing unit 10, a storage unit 11, a presentation unit 16, and a communication unit 17, as shown in FIG. The communication monitoring device 1 executes the program stored in the storage unit 11 by the processing unit 10. The storage unit 11 includes, for example, a storage device such as a disk medium or a semiconductor memory. The communication unit 17 is communicably connected to the network N, and communicates with other devices connected to the network N under the control of the processing unit 10.

  The processing unit 10 has a logical structure including a determination unit 101, a communication restriction unit 102, and a monitoring processing unit 103. The processing unit 10 includes an arithmetic processing device such as a microcomputer. Each unit that the processing unit 10 has as a logical structure may be configured by integrated hardware or may be configured by separate hardware.

  The determining unit 101 monitors communication on the network N from the information acquired by the communication unit 17 and detects that a new device is connected to the network N. The determination unit 101 determines whether a newly connected device is a target device and whether the target device is a legitimate device. The communication restriction unit 102 restricts communication of the target device when the determination unit 101 determines that the target device is not a valid device.

  The monitoring processing unit 103 processes various calculations relating to the monitoring of the determining unit 101. The monitoring processing unit 103 creates the criterion 12 used by the determining unit 101 to determine whether the device is a legitimate device, and stores the criterion 12 in the storage unit 11. The monitoring processing unit 103 acquires the configuration and communication history of the network N from the communication of the network N monitored by the determining unit 101.

  The storage unit 11 stores the registered device information 13, the network information 14, and the monitoring information 15 as the criterion 12. The registered device information 13 is information on the devices 3a to 3c registered in the control device 2, for example, as shown in FIG. The registered device information 13 stores IP (Internet Protocol) addresses, MAC (Media Access Control) addresses, and device type information (instance list) of the devices 3a to 3c in association with the devices 3a to 3c, respectively.

  The control device 2 acquires the registered device information 13 from a communication start notification transmitted by broadcast when starting communication in the management system M so that each of the devices 3a to 3c enters the management system M. The communication start notification is an ARP (Address Resolution Protocol) request for requesting the MAC address (physical address) of the target control device 2.

  The registered device information 13 is acquired by the monitoring processing unit 103 from the control device 2 via the communication unit 17 and stored in the storage unit 11. The registered device information 13 is acquired by, for example, an instance list notification of “ECHONET Lite” (registered trademark), which is a standardized protocol used in HEMS. The instance list includes device type information indicating the type of each of the devices 3a to 3c registered in the control device 2.

  The network information 14 is information on all devices connected to the network N, for example, as shown in FIG. The network information 14 is created by the monitoring processing unit 103 and stored in the storage unit 11. The network information 14 stores a MAC address, an IP address, device type information, and a judgment index in association with all devices connected to the network N. The monitoring processing unit 103 acquires the MAC address, the IP address, and the device type information from the registered device information 13 acquired from the control device 2 or the communication start notification transmitted from each device connected to the network N.

  The judgment index of the network information 14 is determined by the monitoring processing unit 103 based on the MAC address, the IP address, or the device type information. In the judgment index, the device recorded as "router" means the router 6, and the device recorded as "registered" means the devices 3a to 3c. The device recorded as “external device” means other device 5 that has not entered the management system M but is a valid device. Further, the device recorded as “interruption target” means the unauthorized device 4 that has already been determined by the determination unit 101 as not a legitimate device.

  The monitoring information 15 is, for example, as shown in FIG. 5, a history of the determination made by the determining unit 101 that is updated each time the communication unit 17 receives a communication start notification (ARP request). The monitoring information 15 stores the transmission date and time of the communication start notification, the transmission source IP address, the transmission destination IP address (destination IP address), the analysis result of the communication, and the determination result by the determination unit 101 for each communication start notification.

  The determination unit 101 determines whether the device that has transmitted the communication start notification is the target device and determines whether the target device is a valid device in the management system M in response to the communication unit 17 receiving the communication start notification. The determination unit 101 determines whether the target device is a legitimate device by comparing the communication start notification received by the communication unit 17 with the determination criterion 12.

  For example, when the destination IP address of the ARP request transmitted by broadcast is different from the IP address of the control device 2, the determination unit 101 determines that the target device is not a legitimate device. Generally, when joining the management system M, it is necessary to first mutually authenticate with the control device 2 and register it in the control device 2. Therefore, the determination unit 101 determines that the target device other than the control device 2 that requests the MAC address is an unauthorized device.

  When the determination unit 101 determines that the target device is not a legitimate device, the communication restriction unit 102 restricts the communication of the target device by an interfering packet that functions to hinder the communication of the target device. Send to

  For example, the communication restriction unit 102 transmits an interference packet to the unauthorized device 4 that has transmitted the ARP request for requesting the MAC address of the control device 2 with an IP address other than the control device 2 as a destination address. The communication restricting unit 102 transmits, for example, a fake ARP response including a MAC address different from the MAC address of the control device 2 to the unauthorized device 4 as a disturbing packet. The fake ARP response includes, for example, the MAC address of the communication unit 17 of the communication monitoring device 1 as the MAC address of the control device 2. As a result, all packets such as requests transmitted by the unauthorized device 4 to the control device 2 are transmitted to the communication unit 17 of the communication monitoring device 1. The communication unit 17 may discard all packets transmitted from the unauthorized device 4.

  The presentation unit 16 includes a display device that outputs light, images, characters, and the like, a speaker that outputs audio, and the like. The presentation unit 16 presents, to the user, notification information that notifies that an unauthorized device has been detected in the network N in response to the determination unit 101 determining that the target device is not a valid device.

  In the embodiment of the present invention, an unauthorized (unauthorized) device communicates with a standardized protocol, but adversely affects the device and the management system M that are not guaranteed to operate normally in the management system M. Means a device or the like that is supposed to do so.

(Operation of the communication monitoring system)
Hereinafter, an example of the operation of the communication monitoring system according to the embodiment of the present invention will be described using the sequence diagram of FIG.

  For example, in step S101, the device 3a connected to the network N transmits an ARP request for requesting the MAC address of the control device 2 by broadcast. In FIG. 6, a broken line indicates a broadcast, and indicates that the ARP request is transmitted to all devices connected to the network N. In step S102, the control device 2 transmits an ARP response including its own MAC address to the device 3a by unicast in response to the ARP request in step S101. When the control device 2 transmits the ARP response, the device 3a and the control device 2 acquire each other's MAC address, and are connected to be communicable with each other.

  Similarly, when the device 3b transmits the ARP request in Step S103, the control device 2 transmits an ARP response including its own MAC address to the device 3b in Step S104. Similarly, in the case of other devices 5 such as a personal computer, a smartphone, and a tablet terminal, when the device 5 transmits an ARP request in step S105, the control device 2 transmits an ARP response including its own MAC address in step S106. Send to

  The communication monitoring device 1 requests the ARP request in steps S101, S103, and S105 for the MAC address of the control device 2, and the device 3a whose address matches the device 5 and the registered device information 13 based on the criterion 12. , 3b are determined to be valid devices. In this case, the communication monitoring device 1 does not transmit an interference packet for restricting communication to the devices 3a, 3b and the device 5.

  For example, in step S107, the unauthorized device 4 broadcasts an ARP request for the MAC address of the control device 2. In step S108, the control device 2 transmits an ARP response including its own MAC address to the unauthorized device 4 by unicast in response to the ARP request in step S107. By the ARP response, the unauthorized device 4 and a relay device such as a switching hub included in the network N store the MAC address of the control device 2, and the unauthorized device 4 and the control device 2 are temporarily communicably connected. You.

  In step S107, the communication monitoring device 1 detects the source MAC address or the source IP address (source address) included in the ARP request from the address of the device recorded as “interruption target” in the network information 14. I do. In this case, the communication restriction unit 102 transmits a fake ARP response, which is an interfering packet, to the unauthorized device 4 in step S109 after a predetermined time has elapsed after the communication unit 17 received the ARP request in step S107. The process of step S109 may be performed several tens ms to several seconds after the ARP request is received in step S107, for example, so that the process of step S109 is performed after the ARP response of step S108 is securely transmitted.

  Due to the fake ARP response in step S109, the unauthorized device 4 and the relay device such as the switching hub included in the network N overwrite the MAC address of the control device 2 with an address different from the MAC address of the control device 2. Thereby, the communication monitoring device 1 can make the unauthorized device 4 unable to communicate with the control device 2.

  Further, it is assumed that in step S110, the unauthorized device 4 has transmitted an ARP request for requesting the MAC address of the device 3a by broadcast. In step S111, the device 3a transmits an ARP response including its own MAC address to the unauthorized device 4 by unicast in response to the ARP request in step S110. By the ARP response, the relay device such as the switching hub included in the unauthorized device 4 and the network N stores the MAC address of the device 3a, and the unauthorized device 4 and the device 3a are temporarily communicably connected.

  In step S110, the communication monitoring device 1 detects that the destination IP address included in the ARP request is different from the IP address of the control device 2. In this case, the communication restricting unit 102 transmits a fake ARP response, which is a disturbing packet, to the unauthorized device 4 in step S112 after a predetermined time has elapsed since the communication unit 17 received the ARP request in step S110.

  The relay device such as the switching hub included in the unauthorized device 4 and the network N overwrites a different MAC address of the control device 2 as the MAC address of the control device 2 by the false ARP response. Thus, the communication monitoring device 1 can disable the unauthorized device 4 from communicating with the device 3a. The processing in steps S113 to S118 is substantially the same as the processing in steps S110 to S112, and will not be described because they overlap.

−Operation of the communication monitoring device−
Hereinafter, an example of a basic operation of the communication monitoring device 1 when an ARP request is received will be described with reference to a flowchart of FIG.

  First, in step S21, the communication unit 17 receives an ARP request from a target device connected to the network N. In step S22, the determination unit 101 compares the ARP request received by the communication unit 17 with the determination criterion 12 stored in the storage unit 11 to determine whether the target device is a valid device in the management system M. Judge. If it is determined that the target device is valid, the process ends, and if it is determined that the target device is not valid, the process proceeds to step S23.

  In step S23, the communication restricting unit 102 restricts communication of the target device by transmitting, as a fake ARP response, a disturbing packet including the MAC address of the communication unit 17 to the target device determined to be not a legitimate device. .

  According to the communication monitoring system according to the embodiment of the present invention, the communication monitoring device 1 determines whether the target device is a legitimate device based on the ARP request received from the target device and the criterion 12. And restrict the communication of unauthorized devices. Therefore, the connection by the unauthorized device can be easily and appropriately restricted.

  Further, according to the communication monitoring system according to the embodiment of the present invention, the communication monitoring device 1 transmits a fake ARP response including its own MAC address to the unauthorized device, thereby ensuring the unauthorized access in a simple manner. Device communication can be restricted.

(Other embodiments)
As described above, the present invention has been described by the embodiments. However, it should not be understood that the description and drawings forming a part of the present disclosure limit the present invention. From this disclosure, various alternative embodiments, examples, and operation techniques will be apparent to those skilled in the art.

  For example, in the embodiment described above, it is assumed that the IP address of the unauthorized device 4 is “192.168.0.40” as shown in FIG. In this case, if the ARP request received at 12:02:10 is addressed to the control device 2 and there is no information regarding the unauthorized device 4 in the criterion 12, the unauthorized device 4 is determined to be valid. Is determined to be an appropriate device.

  When the unauthorized device 4 sequentially transmits the ARP request to a plurality of other devices within a predetermined time, the determining unit 101 may determine that the unauthorized device 4 is not a legitimate device using this communication pattern. it can. Specifically, in response to the four immediately following ARP requests, the determination unit 101 sequentially raises the alert level of the unauthorized device 4 to “caution”, “alert”, and “shutdown”, and then “shutdown”. Then, it may be determined that the unauthorized device 4 is not a legitimate device.

  Further, the criterion 12 may be appropriately updated based on information on communication performed by the control device 2. Since the request or notification to the control device 2 is transmitted in many cases by unicast, the communication monitoring device 1 may not be able to receive the request or notification. For this reason, the monitoring processing unit 103 acquires information related to the communication performed by the control device 2 from the control device 2 via the communication unit 17 and transmits a plurality of requests within a predetermined time, for example, causing unnatural communication. The determination criterion 12 may be updated so that the device that performs the determination is determined to be an unauthorized device. Further, the monitoring processing unit 103 may acquire unnatural communication of the network N from another device connected to the network N.

  The present invention naturally includes various embodiments and the like not described herein, such as a configuration in which the above-described configuration and operation are applied to each other. Therefore, the technical scope of the present invention is determined only by the invention specifying matters according to the claims that are appropriate from the above description.

DESCRIPTION OF SYMBOLS 1 Communication monitoring apparatus 2 Control apparatus 3a-3c apparatus 4 Unauthorized apparatus 5 Other apparatus 11 Storage unit 12 Judgment standard 13 Registered apparatus information 17 Communication unit 101 Judgment unit 102 Communication restriction unit

Claims (5)

At least one device and one control device configuring a management system that manages each of the at least one device by registering each of the at least one device by mutually authenticating with each of the at least one device. And a communication monitoring device communicably connected via a network,
From a target device connected to the network, a communication unit that receives a communication start notification including a destination address when the target device starts communication in the management system,
A storage unit that stores a criterion for determining whether the device is a valid device in the management system,
By comparing the communication start notification received by the communication unit and the determination criterion stored in the storage unit, a determination unit that determines whether the target device is a legitimate device in the management system. ,
A communication restriction unit that restricts communication of the target device when the target device is determined not to be the legitimate device by the determination unit;
The storage unit stores an address of the control device,
The determination unit, when the communication start notification within a predetermined time with respect to the different destination address of the communication start notification is the address of the previous SL controller device are sequentially transmitted, the target device is not the authorized device A communication monitoring device characterized by determining that: The storage unit stores an address of the device registered in the control device,
The determining unit determines that the target device is a legitimate device when the transmission source address of the communication start notification matches an address of any of the registered at least one device. The communication monitoring device according to claim 1.   2. The communication control unit according to claim 1, wherein the communication control unit limits communication of the target device by transmitting a physical address different from a physical address of the control device to the target device as a physical address of the control device. Or the communication monitoring device according to 2. The communication unit receives information on the communication performed by the control device from the control device,
The communication monitoring device according to any one of claims 1 to 3, wherein the storage unit stores the determination criterion created based on information on communication received from the control device. At least one device and one control device configuring a management system that manages each of the at least one device by registering each of the at least one device by mutually authenticating with each of the at least one device. And a communication monitoring device communicably connected via a network,
The communication monitoring device,
A communication unit configured to receive a communication start notification including a destination address when the target device starts communication in the management system from the target device connected to the network;
A storage unit that stores a criterion for determining whether or not the device is valid in the management system,
By comparing the communication start notification received by the communication unit and the determination criterion stored in the storage unit, a determination unit that determines whether the target device is a legitimate device in the management system, And when the determination unit determines that the target device is not the legitimate device, a communication restriction unit that restricts communication of the target device,
The storage unit stores an address of the control device,
The determination unit, when the communication start notification within a predetermined time with respect to the different destination address of the communication start notification is the address of the previous SL controller device are sequentially transmitted, the target device is not the authorized device A communication monitoring system characterized by determining that:

Images