JP7456331B2 - network system - Google Patents

Description

The present invention relates to a threat notification technique for notifying a security threat detected by a mail monitoring device from e-mails exchanged over a telephone system through a telephone system.

Telephone systems such as business phone systems and PBX systems that connect multiple telephone terminals to a communication network through exchanges are systems that send and receive e-mails using telephone terminals and information processing terminals such as PCs connected under the telephone system. be. On the other hand, e-mails may contain malicious software, so-called viruses (computer viruses). In order to deal with security threats from such infected emails, an email monitoring device such as a UTM (Unified Threat Management) device is connected between the telephone system and the communication network to monitor emails. A so-called network system is used.

Conventionally, as a technology for notifying information regarding e-mail, data communication, DTMF signals, voice signals, etc. are sent to preset users and administrators by reporting the number of e-mails received by the mail system. A technique has been proposed for notifying the user by using the above information (see, for example, Patent Document 1).

Japanese Patent Application Laid-Open No. 7-154418

Generally, viruses are contained in e-mail attachments, and when a user opens the attached file without their knowledge, the virus activates and causes serious damage such as theft, falsification, deletion, or destruction of important information. Therefore, if an infected email is detected, appropriate and prompt countermeasures such as shutting down the information processing terminal that exchanged the infected email should be taken in order to prevent such virus operations and minimize damage. There is a need to.
It is possible to notify the detection of an infected e-mail by using the telephone system included in the network system using the above-described conventional technology. However, according to the conventional technology, since the detection of an infected email is simply notified, it is difficult for the users and administrators who receive the notification to take appropriate and prompt measures against infection as described above. There was a problem.

The present invention is intended to solve such problems, and aims to provide a threat notification technique that not only notifies the detection of a threat but also allows necessary threat countermeasures to be taken appropriately and quickly.

In order to achieve such an object, a network system according to the present invention includes a telephone control device that exchanges and connects a plurality of telephone terminals to a communication network, and a mail monitoring device that monitors e-mails exchanged by the telephone control device. If a security threat is detected from the email, the email monitoring device notifies the telephone control device of the threat detection, and the telephone control device, in response to the notification of the threat detection, The system is configured to notify the user of the occurrence of a threat via email and the corresponding telephone terminal, and to forcibly disconnect the telephone terminal from the corresponding information processing terminal.

Further, in one configuration example of the network system according to the present invention, after the telephone control device notifies the occurrence of a threat at the telephone terminal, the telephone control device sets a contact address set in advance in response to an off-hook operation on the telephone terminal. It is configured to automatically send a call to.

Further, in one configuration example of the network system according to the present invention, the email monitoring device temporarily stores an email in which a threat has been detected, and deletes the email in response to a deletion instruction from the telephone control device. and notifies the telephone control device of the deletion of the threat, and the telephone control device notifies the telephone terminal that the threat has been resolved in response to the notification of threat deletion, and also communicates the deletion of the threat with the information processing terminal corresponding to the telephone terminal. The configuration is such that the connection is automatically restored.

According to the present invention, users who have sent and received e-mails in which a threat has been detected can be notified of the detection of a threat using a telephone system, and information processing terminals with a high possibility of infection can be immediately disconnected from the telephone system. This makes it possible to appropriately and promptly implement necessary threat responses. Therefore, compared to the case where the user or administrator handles the threat, it is possible to prevent the spread of the threat through data communication, and to minimize the damage caused by these threats.

FIG. 1 is a block diagram showing a configuration of a network system. FIG. 3 is a sequence diagram showing a threat response operation. It is an explanatory diagram showing an example of a composition of user information. It is a sequence diagram showing threat response operation (continued).

Next, an embodiment of the present invention will be described with reference to the drawings.
[Network system]
First, with reference to FIG. 1, a network system 1 according to the present embodiment will be described. FIG. 1 is a block diagram showing the configuration of a network system.
This network system 1 includes a telephone system 10 and a mail monitoring device 20, and the mail monitoring device 20 monitors e-mails exchanged by the telephone system 10 via a communication network NW, and detects virus infection from the e-mails. In this case, the telephone system 10 is used to notify the user.

[Telephone System]
The telephone system 10 is composed of telephone systems such as a business phone system and a PBX system, and is configured to provide users with telephone services using a plurality of telephone terminals T connected thereto by switching and connecting these telephone terminals T to a communication network NW. The telephone system 10 is also configured to provide users with data communication services using information communication terminals D connected thereto, such as PCs, smartphones, and tablets, by connecting these information communication terminals D to the communication network NW.

As shown in FIG. 1, the telephone system 10 includes a telephone control device 11, a HUB 12, a telephone terminal T, and an information processing terminal D as main components.
[Telephone control device]
The telephone control device 11 is composed of a main device of a business phone system and a PBX device of a PBX system as a whole, and controls calls of the communication network NW and the telephone terminal T by exchanging control messages with the communication network NW and the telephone terminal T. It is composed of Further, the telephone control device 11 is configured to relay data communications such as e-mail and WEB access between the telephone terminal T or information processing terminal D and the communication network NW.

Further, in response to the threat detection notification from the email monitoring device 20, the telephone control device 11 notifies the occurrence of a threat via the user's telephone terminal T corresponding to the e-mail in which the threat was detected, and also communicates the occurrence of a threat with the telephone terminal T of the user corresponding to the e-mail in which the threat was detected. After forcibly disconnecting from the corresponding information processing terminal D and notifying the occurrence of a threat on the telephone terminal T, a call is automatically made to a preset contact in response to an off-hook operation on the telephone terminal T. It is configured.
Further, in response to the threat deletion notification from the email monitoring device 20, the telephone control device 11 notifies the user's telephone terminal T corresponding to the e-mail in which the threat has been detected that the threat has been eliminated, and also It is configured to automatically restore the connection with the corresponding information processing terminal D.

[HUB]
The HUB 12 is a general hub device, and is configured to relay-connect the telephone terminal T and information processing terminal D to the telephone control device 11 via a LAN line.
Further, the HUB 12 disconnects the specified information processing terminal D in response to a disconnection instruction from the telephone control device 11, and disconnects the specified information processing terminal D in response to a recovery instruction from the telephone control device 11. is configured to restore connectivity with the

The telephone terminal T can be connected to the telephone control device 11 directly via a LAN line or a dedicated line, or to the telephone control device 11 via a HUB 12 and a LAN line. The information processing terminal D can be connected to the telephone control device 11 via a HUB 12 and a LAN line, or to the telephone control device 11 via a telephone terminal T.

FIG. 1 shows a configuration example in which one telephone terminal T and one information communication terminal D are assigned to each of three users U1, U2, and U3. The telephone terminal T1 of the user U1 is directly connected to the telephone control device 11, and the information communication terminal D1 of the user U1 is connected to the telephone control device 11 via the HUB12. Further, the telephone terminal T2 and the information communication terminal D2 of the user U2 are both connected to the telephone control device 11 via the HUB 12. Further, the telephone terminal T3 of the user U3 is connected to the telephone control device 11 via the HUB 12, and the information communication terminal D3 of the user U3 is connected to the telephone control device 11 via the telephone terminal T3. .

Further, the telephone control device 11 has a function of group-managing the telephone terminals T connected under its control, for example, according to the affiliation of the users. In the example of FIG. 1, telephone terminals T1 and T2 are assigned to group A to which users U1 and U2 belong, and telephone terminal T3 is assigned to group B to which user U3 belongs. Note that the number of connections, connection form, and group assignment of the telephone terminal T and information communication terminal D are not limited to these, and may vary depending on the application. Group assignments may be changed as appropriate.

[Telephone terminal]
The telephone terminals T are generally general telephone terminals used as internal telephone terminals in business phone systems and PBX systems, and are configured to be connected under the telephone control device 11 and to perform voice calls and display various information by performing data communication with the telephone control device 11. Some telephone terminals T have the function of sending and receiving e-mails and a browser function for accessing the Internet, and some have the function of connecting an information processing terminal D under their control.

[Email monitoring device]
The email monitoring device 20 consists of a communication control device such as a UTM (Unified Threat Management) device and a router, and is connected between a communication network NW such as the Internet and the telephone control device 11 of the telephone system 10. Then, e-mails exchanged between the telephone terminal T and the information communication terminal D via the telephone control device 11 are monitored, and if a security threat such as a virus infection is detected from the e-mail, the telephone control device 11 is instructed to detect the threat. Configured to notify you.
Additionally, the mail monitoring device 20 temporarily stores e-mails in which a virus has been detected, that is, infected e-mails, deletes the e-mails in response to a deletion instruction from the telephone control device 11, and deletes the threat from the telephone control device 11. 11.

[Administrator terminal]
The administrator terminal 30 is a telephone terminal of an administrator who manages the security of the network system 1. The administrator terminal 30 may be a call center that manages the network system 1, or may be an extension terminal within the telephone system 10. For example, when the network system 1 is exposed to a security threat, in response to a telephone inquiry from a user of the network system 1, the administrator instructs appropriate measures to deal with the threat from the administrator terminal 30. can do.

[Operation of this embodiment]
Next, the operation of the network system 1 according to this embodiment will be described with reference to FIGS. 2, 3, and 4. FIG. 2 is a sequence diagram showing threat response operations. FIG. 3 is an explanatory diagram showing an example of the configuration of user information. FIG. 4 is a sequence diagram showing the threat response operation (continued).
Here, a description will be given of a threat response operation that is executed in the network system 1 when a received email contains a security threat such as a virus or malware.

As shown in FIG. 2, when the telephone system 10 receives an e-mail from the communication network NW (step S100), the e-mail monitoring device 20 determines whether the received e-mail contains a security threat such as a virus or malware. It is confirmed whether the information is correct (step S101). Here, if a threat is detected, the mail monitoring device 20 notifies the telephone control device 11 of the threat detection (step S102). This threat detection notification includes an e-mail address for identifying the related user or information processing terminal D extracted from the e-mail.

When the telephone control device 11 is notified of a threat detection from the email monitoring device 20, the telephone control device 11 refers to the preset user terminal information and selects the phone to be subjected to threat processing from the email address included in the threat detection. Terminal T and information processing terminal D are identified (step S103). Here, the extension number assigned to the user's telephone terminal T is specified, and the MAC address and connection form of the information processing terminal D corresponding to the telephone terminal T are specified.

The user information shown in Figure 3 includes, for each user's name, the extension number of the telephone terminal used by the user, the group to which the user belongs, the user's email address, and the information ( The MAC address of the information processing terminal D (corresponding to the telephone terminal) and the connection form of the information processing terminal D are registered as a set. Among the connection types, "HUB" indicates that the information processing terminal D is connected to the telephone control device 11 via the HUB 12. Further, "KT" indicates that the information processing terminal D is connected to the telephone control device 11 via the telephone terminal T.

Next, based on the specified extension number, the telephone control device 11 notifies the occurrence of a threat via the user's telephone terminal T corresponding to the e-mail in which the threat was detected (steps S110, S120, S130), and the obtained information Based on the MAC address of the processing terminal D, the connection between the telephone terminal T and the corresponding information processing terminal D is forcibly disconnected (steps S112, S122, S132).

For example, if the email address included in the threat detection is "saxa11@saxa.jp", the telephone control device 11 identifies the extension number "11" from the user information in FIG. 3, and directly notifies the telephone terminal T1 of the corresponding user U1 of the occurrence of the threat (step S110). As a result, the telephone terminal T1 notifies user U1 that a threat has occurred due to the email sent or received by user U1, for example, by displaying a blinking incoming call lamp or a message on the LCD (step S111). At this time, the occurrence of the threat may be reported immediately, or may be reported only during a system-set time period or when a motion sensor is detected.

Furthermore, if the email address included in the threat detection is "saxa11@saxa.jp", the telephone control device 11 uses the user information shown in FIG. 3 as the MAC address "AA-AA-AA-AA-AA-11" and the connection type "HUB", and notifies the HUB 12 of an instruction to disconnect the corresponding information processing terminal D1 (step S112). As a result, the HUB 12 is forcibly disconnected from the information processing terminal D1, making data communication at the information processing terminal D1 impossible (step S113). Therefore, even if the information processing terminal D1 is infected with malicious software such as a virus or malware, it is possible to prevent the spread through data communication and to minimize the damage caused by these threats.

Furthermore, if the email address included in the threat detection is "saxa12@saxa.jp", the telephone control device 11 identifies the extension number "12" based on the user information in FIG. The occurrence of a threat is notified to the terminal T2 via the HUB 12 (step S120). As a result, the telephone terminal T2 notifies the user U2 that a threat has occurred due to the e-mail sent and received by the user U2, for example, by displaying a blinking incoming call lamp or displaying a message on the LCD (step S121). At this time, the occurrence of a threat may be notified immediately, or may be notified only during a system-set time period or when a human sensor is detected.

Furthermore, if the email address included in the threat detection is "saxa12@saxa.jp", the telephone control device 11 uses the user information shown in FIG. 3 as the MAC address "AA-AA-AA-AA-AA-12" and the connection type "HUB", and notifies the HUB 12 of an instruction to disconnect the corresponding information processing terminal D2 (step S122). As a result, the HUB 12 is forcibly disconnected from the information processing terminal D2, making data communication at the information processing terminal D2 impossible (step S123). Therefore, even if the information processing terminal D2 is infected with malicious software such as a virus or malware, the spread through data communication can be suppressed, and the damage caused by these threats can be suppressed to a minimum.

Furthermore, if the email address included in the threat detection is "saxa13@saxa.jp", the telephone control device 11 identifies the extension number "13" based on the user information in FIG. The occurrence of a threat is notified to the terminal T3 via the HUB 12 (step S130). As a result, the telephone terminal T3 notifies the user U3 that a threat has occurred due to the e-mail sent and received by the user U3, for example, by displaying a blinking incoming call lamp or displaying a message on the LCD (step S131). At this time, the occurrence of a threat may be notified immediately, or may be notified only during a system-set time period or when a human sensor is detected.

Additionally, if the email address included in the threat detection is "saxa13@saxa.jp", the telephone control device 11 uses the user information shown in FIG. 3 as the MAC address "AA-AA-AA-AA-AA-13" and connection type "KT", and notifies the telephone terminal T3 via the HUB 12 of a disconnection instruction for the corresponding information processing terminal D3 (step S132). As a result, the telephone terminal T3 is forcibly disconnected from the information processing terminal D3, and data communication at the information processing terminal D3 becomes impossible (step S133). Therefore, even if the information processing terminal D3 is infected with malicious software such as a virus or malware, it is possible to prevent the spread through data communication and to minimize the damage caused by these threats.

After notifying the telephone terminal T of the occurrence of a threat and disconnecting the information processing terminal D in this way, the telephone control device 11 targets the telephone terminal T and sends a message to the preset administrator terminal 30. Waiting for an automatic call is started (step S140).
For example, if the notification destination of the occurrence of a threat is the telephone terminal T1, in response to an off-hook operation on the telephone terminal T1 (step S141), the telephone control device 11 executes an automatic call to the administrator terminal 30 (step S142). ).

In response, the telephone control device 11 notifies the communication network NW of a call request to the administrator terminal 30 (step S143), and in response to the response from the administrator terminal 30 (step S144). , a voice call between the administrator terminal 30 and the telephone terminal T1 is started (step S145). Thereby, in response to an inquiry from the user U1, the administrator will instruct appropriate measures to deal with the threat.

Thereafter, when the user U1 instructs the deletion of the stored infected e-mail in response to an instruction from the administrator (step S150), the telephone control device 11 notifies the e-mail monitoring device 20 of this instruction.
In response to this deletion instruction, the mail monitoring device 20 deletes the infected mail being stored (step S151), and notifies the telephone control device 11 of the threat deletion indicating that the threat has been deleted (step S152).

In response to the notification of threat deletion from the email monitoring device 20, the telephone control device 11 refers to the user terminal information set in advance to target the email address included in the threat detection. The telephone terminal T and the information processing terminal D are specified (step S153).
Here, for example, if the telephone terminal T1 and information processing terminal D1 of the user U1 are identified, the telephone control device 11 notifies the telephone terminal T1 that the threat has been resolved (step S154). As a result, the telephone terminal T1 notifies the user U1 that the threat has been resolved, for example, by displaying a blinking incoming call lamp or displaying a message on the LCD (step S155).

Further, the telephone control device 11 notifies the HUB 12 of a recovery instruction for the information processing terminal D1 (step S156). As a result, the connection with the information processing terminal D1 is restored in the HUB 12, and data communication with the information processing terminal D1 becomes possible (step S157). Therefore, in response to the deletion of the infected email, the user is automatically notified that the threat has been resolved, and the information processing terminal D1 is automatically reconnected, without requiring any countermeasure work.

[Effects of this embodiment]
As described above, in this embodiment, when the email monitoring device 20 detects a security threat from an email, the email monitoring device 20 notifies the telephone control device 11 of the threat detection, and the telephone control device 11 responds to the threat detection notification. In response, the user's telephone terminal T corresponding to the e-mail notifies the user of the occurrence of a threat, and also forcibly disconnects the telephone terminal T from the corresponding information processing terminal D.

As a result, users who have sent and received e-mails in which a threat has been detected can be notified of the detection of a threat using the telephone system 10, and information processing terminal D with a high possibility of infection can be immediately disconnected from the telephone system 10. This makes it possible to appropriately and promptly implement necessary threat responses.
Therefore, compared to the case where the user or administrator handles the threat, it is possible to prevent the spread of the threat through data communication, and to minimize the damage caused by these threats.

Further, in this embodiment, after the telephone control device 11 notifies the occurrence of a threat on the telephone terminal T, the telephone control device 11 automatically makes a call to a preset contact in response to an off-hook operation on the telephone terminal T. It's okay. This eliminates the need for the user to look up the administrator's phone number and allows the user to more quickly notify the administrator of the occurrence of a threat.

Further, in the present embodiment, the mail monitoring device 20 temporarily stores the e-mail in which a threat has been detected, deletes the e-mail in response to a deletion instruction from the telephone control device 11, and deletes the threat by telephone. In response to the threat deletion notification, the telephone control device 11 notifies the telephone terminal T that the threat has been eliminated, and automatically restores the connection between the telephone terminal T and the corresponding information processing terminal D. You can do it like this. As a result, the user is automatically notified that the threat has been resolved upon deletion of the infected email, without the need for any countermeasures, and the information processing terminal D is automatically reconnected to enable data communication. becomes.

[Extended embodiments]
Although the present invention has been described above with reference to the embodiment, the present invention is not limited to the above embodiment. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention.

In the above, an example has been described in which the occurrence of a threat and the resolution of a threat are notified only by the telephone terminal T of the user who sent and received the e-mail in which the threat was detected, but the present invention is not limited to this. For example, the group set in the user information in FIG. 3 may be referred to, and the notification may be made by the telephone terminal T of the group to which the corresponding user belongs. As a result, the occurrence of a threat and the resolution of the threat can be shared among users belonging to the group, and threats can be dealt with efficiently.

DESCRIPTION OF SYMBOLS 1...Network system, 10...Telephone system, 11...Telephone control device, 12...HUB, 20...Mail monitoring device, 30...Administrator terminal, T, T1, T2, T3...Telephone terminal, D, D1, D2, D3 ...Information processing terminal, NW...Communication network.

Claims (3)

a telephone control device for switching and connecting a plurality of telephone terminals to a communication network;
a mail monitoring device that monitors electronic mail exchanged by the telephone control device;
When a security threat is detected from the email, the mail monitoring device notifies the telephone control device of the threat detection;
The network system is characterized in that, in response to the notification of the threat detection, the telephone control device notifies the telephone terminal of the user corresponding to the email of the occurrence of the threat and forcibly disconnects the connection between the telephone terminal and the corresponding information processing terminal. The network system according to claim 1,
The network system is characterized in that the telephone control device, after notifying the occurrence of a threat at the telephone terminal, automatically makes a call to a preset contact in response to an off-hook operation on the telephone terminal. The network system according to claim 1 or claim 2,
The email monitoring device temporarily stores the email in which a threat has been detected, deletes the email in response to a deletion instruction from the telephone control device, and notifies the telephone control device of threat deletion;
The network system is characterized in that, in response to the threat deletion notification, the telephone control device notifies the telephone terminal that the threat has been eliminated, and automatically restores the connection between the telephone terminal and the corresponding information processing terminal.

Images