JPH07264178A - Security system - Google Patents

Abstract

PURPOSE:To obtain the security system in which illegal access is inhibited and an address accessed illegally is located. CONSTITUTION:The system is provided with repeaters 21-24 informing alarm information when illegal access takes place to terminal equipments 51-55 on LANs 11-14 connecting to a concerned repeater from any of the terminal equipments 51-55 and a management equipment 56 displaying the content when alarm information is received. The management equipment 56 retrieves to which port of each of the repeaters 21-24 the terminal equipment making illegal access is connected based on the alarm information and the access history information having each of the repeaters 21-24 to locate to which LAN the terminal equipment is connected.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a security system, in particular, a network system constructed by a transmission medium such as a plurality of local area networks (hereinafter referred to as LAN) or public networks, and illegally accesses a prohibited terminal device. Security method for locating a terminal device that has tried

[0002]

2. Description of the Related Art Conventionally, in a network system constructed by connecting a plurality of LANs via a relay device such as a bridge or a router, for controlling access such as communication disabled between terminal devices connected to different LANs. Various security methods are adopted in.

For example, Japanese Patent Laid-Open No. 3-28039 discloses a method of prohibiting unauthorized access from an unauthorized terminal device by using various tables. FIG. 8 is a configuration diagram of a conventional local area network system disclosed in Japanese Patent Laid-Open No. 3-2803939.

Main line LAN 1 and each branch line LAN 2-1 to 2-
4 are connected by node devices N21 to N24 to which addresses NA1 to NA4 are respectively assigned. Branch line L
Address TA unique to any of AN2-1 to 2-4
1 to TA5 is assigned to the terminal device T, and the branch line L
A network management station NMS to which an address NMA is assigned is connected to the AN 2-1. The node devices N21 and N22 are grouped as a group having a group number G1 and node devices N23 and N24 having a group number G2.

Each of the node devices N21 to N24 has branch line side filtering tables TBS1 to TBS4 for registering the addresses TA1 to TA5 of the terminal devices T connected to the branch lines LAN2-1 to 2-4 connected to its own node device, The trunk side filtering tables TBK1 to TBK4 that register the addresses TA1 to TA5 of the terminal devices T that are not connected to the own node device, that is, that are connected to the main line LAN1 side when viewed from the own node device, and the addresses of privileged terminal devices are registered. Privileged terminal tables TTB1 to TTB4 and the NM for registering the address NMA of the network management station NMS
It has S address tables NTB1 to NTB4, respectively.

Next, in this conventional example, the address TA
Terminal device T of 3 (hereinafter referred to as terminal device T (TA3))
Terminal device T (TA4) for which access is not permitted from
The operation when a frame is transmitted to will be described. The frame used for communication includes the destination address and the source address.

The node device N22 has a terminal device T (TA
When the frame is received from 3), the address TA4 of the destination terminal device T (TA4) is added to the branch line filtering table TBS2, as is clear from the fact that the terminal device T (TA4) is not connected to the local branch line LAN2-2. Is not registered, the group number G1 is added to the frame and the frame is transferred to the trunk LAN1.

After confirming that the frame number received from the trunk LAN 1 has a different group number from that of the node device N23, the node device N23 performs the following procedure.

First, the contents of the destination address of the frame are searched from the NMS address table NTB3.
Since the address TA3 of the terminal device T (TA3) which is the source is not registered, the contents of the source address of the frame are searched from the privileged terminal table TTB3. Since the address TA3 of the terminal device T (TA3) is not registered, the content of the source address of the frame is searched from the NMS address table NTB3 next. Since the address TA3 of the terminal device T (TA3) is not registered, as a result, the frame is discarded.

In this way, the node devices N21 to N24 in the conventional example prohibit unauthorized access by discarding frames from the terminal device T for which access is not permitted.

[0011]

However, in the prior art, it is possible to prohibit unauthorized access by discarding the frame as described above, but it is not possible to know the fact that the unauthorized access was attempted. Therefore, it cannot be known from which terminal device the unauthorized access was attempted.

The present invention has been made to solve the above problems, and an object thereof is to provide a security system capable of not only prohibiting unauthorized access but also specifying the location of unauthorized access. Especially.

[0013]

In order to achieve the above-mentioned object, the invention according to claim 1 provides a transmission medium for connecting a terminal device to which a unique address is allocated, and the transmission medium. A security method that includes a relay device that relays communication of the terminal device pipe and a management device that is connected to any of the transmission media and manages a network system, and that allows communication only between permitted terminal devices. In the above, the relay device notifies the management device of alarm information when detecting unauthorized access or failure to the terminal device on the transmission medium connected to the own relay device.

According to a second aspect of the present invention, in the security system according to the first aspect, the relay device has an alarm notification condition registration means for registering a condition for notifying the alarm information.

According to a third aspect of the present invention, in the security system according to the first aspect, the management device has means for displaying the received alarm information.

According to a fourth aspect of the present invention, in the security system according to the first aspect, the management device accesses the arbitrary relay device via the transmission medium connected to the own relay device. Is included, and means for requesting transmission of access history information is recorded.

According to a fifth aspect of the present invention, in the security system according to the fourth aspect, the management device is connected to the terminal device that has made an unauthorized access from the access history information and the alarm information received from the relay device. It is characterized in that it has means for specifying the transmission medium that has been set.

According to a sixth aspect of the present invention, in the security system according to the fourth aspect, the management device has means for specifying the terminal device from the alarm information received from the relay device.

The invention according to claim 7 is the security system according to claim 1 and claims 3 to 6, wherein each management device is realized by a terminal device.

According to an eighth aspect of the present invention, in the security system according to the first aspect, the relay device determines whether to permit / prohibit the relay control of the received frame based on the set permission / prohibition information, It is characterized in that an unauthorized access or a failure is detected based on the alarm information notification condition set when it is determined that the relay control is prohibited.

[0021]

In the security system according to the present invention having the above-mentioned structure, when the relay device detects an unauthorized access, the relay device notifies the management device of alarm information, so that the management device detects that there is an unauthorized access. It is possible to notify the network administrator or the like by displaying the content.

The alarm notification condition registration means can set and register the conditions for notifying the management device of the alarm information.

The management device requests the transmission of the access history information from an arbitrary relay device, and from the access history information and the alarm information obtained as a result, determines the transmission medium to which the terminal device that has made an unauthorized access is connected. Can be specified.

Further, the management device can request the transmission of the access history information from any relay device, and can specify the terminal device that has made an unauthorized access from the alarm information obtained as a result.

In addition, the relay device is set to permit / set.
Permitting relay control of received frames based on prohibition information /
Make a prohibition decision. As a result, when it is determined that the relay control is prohibited, it is determined whether or not the alarm notification is necessary based on the alarm information notification condition that is set. When it is determined that there is a need, an unauthorized access or failure is detected, and alarm information is notified to the management device. Therefore, the management device can detect that there is an unauthorized access.

[0026]

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT A preferred embodiment of the present invention will be described below with reference to the drawings.

FIG. 1 is a block diagram of a network system in which the security system of this embodiment is implemented.

LANs 11, 12, 13, which are transmission media,
14 and 15 are relay devices 21, 22, 23 and 2, respectively.
Connected with 4. LAN 11, 12, 13, 1
Terminal devices 51, 52, 53, 54, 55 to which unique addresses are assigned to either
Are connected, and the terminal devices 51 to 55 can physically communicate with each other via the LANs 11 to 15 and the relay devices 21 to 24. A management device 56, which is a terminal device and manages the entire network system, is connected to the LAN 12. Each of the relay devices 21 to 24 has a LAN 11 to
It has a port for physically connecting 15 to each other. Of course, three or more ports may be provided, but as shown in the figure, each of the relay devices 21 to 24 in this embodiment is connected to two LANs, respectively, and therefore has two port numbers P1. , P2 ports 21a, 21b, 22a, 2
2b, 23a, 24b, 24a, 24b.

FIG. 2 is a diagram showing the configuration of the relay device 21. The relay device 21 includes the ports 21a and 21b described above.
And a control unit 21c that controls the processing in the relay device 21.
And a relay control table 21d in which information about the terminal device that permits / prohibits relay is registered. The information registered in the relay control table 21d includes the address of the privileged terminal device and the address of the management device 56. Further, the relay device 21 in the present embodiment notifies the management device 56 of the alarm information and the access information notification unit 21e which notifies the management device 56 of the alarm information via the port when there is an unauthorized access or a failure. And an alarm information notification condition registration unit 21f for registering the power condition. As a result, it is possible to notify the management device 56 that there has been an unauthorized access or the like.
Furthermore, the relay device 21 in the present embodiment records the access status via the LANs 11 and 15 connected to the relay device 21, that is, the access history of which terminal device has made an access request to which terminal device. The access history information storage unit 21g is provided. FIG. 3 is access history information held by each of the relay devices 21 to 24, in which the port number of the side that received the frame used in the inter-terminal communication and the address of the terminal device that is the source of the frame are Corresponding and recorded. As a result, it is possible to know which side of the relay devices 21 to 24 the terminal device that is the source of the frame exists in the LAN. The other relay devices 22, 23, 24 have the same configuration. It should be noted that the frame used for communication between the terminal devices in the present embodiment needs to include at least the source address and the destination address.

FIG. 4 is a diagram showing the configuration of the management device 56. The management device 56 includes an input / output unit 56a that transmits / receives frames and the like to / from another device via the LAN 12, a control unit 56b that controls processing in the present device, and a memory 5
6c and. Furthermore, the management device 5 in this embodiment
6 is characterized by having an alarm information display unit 56d for displaying alarm information received from the relay devices 21 to 24, whereby the fact that an unauthorized access has been made to any of the terminal devices can be immediately reported to the system. You can notify the administrator etc. Furthermore, the management apparatus 56 according to the present embodiment further includes an access history information transmission request unit 56e capable of requesting the transmission of the access history information stored in each of the relay apparatuses 21 to 24 to any of the relay apparatuses 21 to 24. It is characterized by having the management device 5
6, which terminal devices 51 to 55 are relay devices 21 to
It is possible to know which side of 24 is present.

FIG. 5 shows the relay devices 21 to 21 in this embodiment.
24 is a flowchart showing the processing of No. 24, and the operation of the relay devices 21 to 24 in the present embodiment will be described below based on this.

As an example, a case where a frame is transmitted (accessed) from the terminal device 54 to the terminal device 51 will be described.

First, the case where nothing is set in the relay control table 21d of each of the relay devices 21 to 24 will be described.

When the relay device 24 receives a frame from the terminal device 54 via the LAN 14 and the port 24b, the relay device 24 stores the address (X_adr) of the terminal device 54 and the received port number P2 in the access history information storage unit 21g in association with each other. (Save) (step 101). In addition, port 2
The terminal devices on LANs 14 and 15 connected to 4a and 24b may be set in the access history information storage unit 21g in advance. Here, it is determined whether or not there is a setting in the relay control table 21d (step 102). in this case,
Since there is no setting, the port number received in the frame then compares and refers to whether the address (H_adr) of the terminal device 51 in the access history information is the same port number as the terminal device 54 (step 103). If the terminal device 51 has the same port number P2 as the terminal device 54,
It is determined that the terminal device 51 is on the same LAN 14,
It is not necessary to send the frame to another LAN. Therefore, the frame is discarded (step 108). Further, the terminal device 51 has the same port number P2 as the terminal device 54.
If not, the frame is transmitted from the port (step 109). In this embodiment, the frame is transmitted from the port number P1. If the address of the terminal device 51 is not yet stored, the frame is transmitted from the port 24a other than the port that received the frame (step 10).
9). The frame transmitted from the port 24a is the LAN
It is received by the relay devices 21, 22, and 23 connected to 15. When receiving the frame, each relay device 21,
The address (X_adr) of the terminal device 54 and the received port number P1 are stored in association with each other in the access history information storage unit 21g in 22 and 23 (step 101). Here, in each of the relay devices 21, 22, and 23, the destination address (H_adr in this example) in the frame is referred to, and the destination address and the port number other than the received port are stored in the own access history information storage unit 21g (this embodiment). In the example, only P2) is searched for whether there is access history information associated with. In this example, since it is recorded in the access history information storage unit 21g of the relay device 21, only the relay device 21 sends the frame from the port 21b. The other relay devices 22 and 23 discard the frame.

In this way, when nothing is set in the relay control table 21d of each of the relay devices 21 to 24,
The terminal device 51 can receive the frame transmitted from the terminal device 54 via the LAN 11.

Next, the relay control table 2 of the relay device 21
A case where permission / prohibition information for the terminal device is set and registered in 1d will be described. In the present embodiment, the following permission / prohibition information (1) and (2) are set.

(1) Permitting bidirectional frame relay between the terminal device 51 and the terminal device 53.

(2) The relay of frames from terminal devices connected to the LANs 13 and 14 is prohibited.

Further, in the alarm information condition registering section 21f of the relay device 21, a condition for notifying the alarm information when a frame is received from a terminal device connected to the LANs 13 and 14 is registered.

Even with such setting, frame transmission / reception, that is, access between the terminal devices 51, 52, 53 is possible. In addition, the terminal devices 53, 54,
Access between 55 is also possible.

Here, similar to the above, the case of transmitting (accessing) a frame from the terminal device 54 to the terminal device 51 will be described, but the description of the same operation as the above, which is not main, is omitted.

When the terminal device 54 sends the frame, the relay device 24 sends the frame from the terminal device 54 to the LAN1.
4, the address (X_adr) of the terminal device 54 and the received port number P2 are stored in the access history information storage unit 21g in association with each other (step 101). Here, since nothing is set in the relay control table 21d of the relay device 24 (step 102), the frame is transmitted from the port number P1 (step 109) as in the above.

Upon receiving the frame from the relay device 24, the relay device 21 stores the address (X_adr) of the terminal device 54 and the received port number P1 in the access history information storage unit 21g in association with each other (step 101). Here, it is determined whether or not there is a setting in the relay control table 21d (step 102). In this case, since there is a setting, it is next determined whether relay control is permitted (step 104). As described above, since the permission / prohibition information (1) and (2) is set in the relay control table 21d of the relay device 21 as described above, the permitted relay control is performed by the terminal device 51 and the terminal device 53. It only relays bidirectional frames between. Next, it is determined whether the relay control is prohibited (step 105). As described above, the terminal device 24 connected to the LAN 14 of this example
Since the relay of the frames from 1 to 3 is prohibited, the alarm information notification unit 21e next determines the necessity of alarm notification (step 106). As described above, the LAN 1 is included in the alarm information condition registration unit 21f of the relay device 21.
When a frame is received from the terminal device 54 connected to No. 4, the condition for notifying the alarm information is registered.
The alarm information is notified from a to the management device 56 (step 107). The alarm information to be notified includes information such as an address that can identify the relay device that is the alarm information sending source, the source of the frame, and the address of the terminal device that is the destination. After the alarm information is notified, the relay device 21 discards the frame (step 108).

As described above, any of the relay devices 21 to 24, which has detected the unauthorized access, can notify the management device 56 of the alarm information.

Next, the operation of the management device 56 after receiving the alarm information will be described.

When the management device 56 receives the alarm information via the input / output unit 56a, the management device 56 stores the content in the memory 56c and CR by the alarm information display unit 56d.
It is displayed on an output device such as T or a printer. This allows
It is possible to notify the network administrator or the like that an unauthorized access or failure has occurred in the network system managed by the management device 56.

Further, in the present embodiment, not only can it be known that there has been an unauthorized access, but also to which relay device the terminal device that has made an unauthorized access is connected to the LAN.
It is characterized by being able to specify whether it is above.
The operation of identifying the LAN will be described below.

Since the management device 56 can identify the relay device which has issued the alarm information from the content of the received alarm information, the access history information transmission requesting part 56e causes the relay device 21 to send the alarm information to the relay device 21. Send a request to send access history information. When the access history information is received from the relay device 21, the terminal device 54 that has made an unauthorized access from the content of the access history information determines that the port 21 a of the relay device 21.
It can be seen that it exists on the (port number P1) side. Conversely, it can be seen that the terminal device 54 does not exist on the port number P2 side at this point. Next, port 2 of the relay device 21
Since LAN15 is connected to 1a, LAN15
A request for transmitting access history information is sent to the relay device connected to the relay device, that is, the relay devices 22, 23 and 24 in this embodiment. When the access history information is received from each of the relay devices 22, 23, 24, the management device 56 determines which port side of each of the relay devices 22, 23, 24 the terminal device 54 that has made an unauthorized access is located, as described above. Determines. In the relay devices 22 and 23, the terminal device 54 has the ports 22a and 23a (port number P1) of the relay devices 22 and 23.
You can see that it exists on the side. On the other hand, it can be seen from the access history information of the relay device 24 that the terminal device 54 exists on the port 24b (port number P2) side of the relay device 24.

As described above, the management device 56 identifies from the alarm information and the access history information that the terminal device 54 that has made an unauthorized access exists on the LAN 14 connected to the port 24b of the relay device 24. be able to. Even if a relay device other than the relay device 24 is connected to the LAN 14 and has a hierarchical network structure, it is possible to specify the terminal device that has made an unauthorized access by repeating the above method. By displaying the specified contents on the output device, not only the unauthorized access but also the alarm information received from the relay device is used to identify which LAN is connected to the terminal device for the unauthorized access. You can notify the administrator etc.

It should be noted that the access history information is automatically changed as early as possible when the connection position of the relay device is changed, the connection configuration of the transmission medium is changed or added, the connection position of the terminal device is changed, or the active state of the terminal device is changed. In order to reflect in the above, there is a method of adding a timer counter to the content held in the access history information as shown in FIG. Terminal device 5 as an example
The operation of the relay device 24 when transmitting a frame from the No. 4 to the terminal device 51 will be described, but the description of the same operation as the above, which is not main, is omitted. The relay device 2
In 4, a refresh time value (threshold value) for refreshing the access history information is registered in advance.

The relay device 24 includes the access history information section 21.
The address of the terminal device 54 (X adr)
The address of the terminal device 54 is stored again when the gateway number P1 is stored.
(X memory timer counter (Tx) for adr)
Register as an initial value of zero. After that, the same frame is the same
When receiving from the port, the address of the terminal device 54
(X adr) and register the memory timer counter (Tx)
The initial value is zero. On the other hand, at a fixed time due to a timer interrupt
The process of FIG. 7 is called at every interval. Access history information
The storage timer counter (Ta, Tb, Th,
(Tm, Tx, Ty) and refresh time value
If the memory timer counter is large, the memory timer
Delete the address corresponding to the counter. Next, memory
Equivalent to the time that the Imma counter is called at regular time intervals
Automatic refresh processing of access history information by adding minutes
To finish.

Although the present embodiment has been described with respect to the detection of unauthorized access, it can be applied to other detections depending on the setting contents of the condition for notifying the management device of the alarm information.

Further, although the present embodiment has been described with respect to specifying the terminal device which has been illegally accessed by the management device or the terminal device in which a failure has occurred, and specifying the transmission medium to which the terminal device is connected. It can also be realized by installing software having a function corresponding to the management device 56 in the terminal device.

[0054]

As described above, according to the present invention, when the relay device detects an unauthorized access or the like based on the permission / prohibition information and the alarm information notification condition, the relay device notifies and displays the alarm information. Therefore, it becomes possible for the network administrator or the like to know that there has been an unauthorized access.

Further, by providing the alarm notification condition registering means, it becomes possible to arbitrarily set the condition for notifying the management device of the alarm information.

Further, by providing the means for identifying the terminal device that has made the unauthorized access from the access history information and the alarm information obtained by the transmission request, it is possible to know not only the unauthorized access. It is possible to specify which transmission medium the terminal device is connected to.

Further, the management device can be realized in a general terminal device by adding the function of the management device.

[Brief description of drawings]

FIG. 1 is a configuration diagram of a network system in which a security system according to the present invention is implemented.

FIG. 2 is a diagram showing a configuration of a relay device in the present embodiment.

FIG. 3 is a diagram showing access history information held by each relay device in the present embodiment.

FIG. 4 is a diagram showing a configuration of a management device according to the present exemplary embodiment.

FIG. 5 is a flowchart showing processing of the relay device according to the present embodiment.

FIG. 6 is a diagram showing access history information including a storage timer counter included in a relay device in the present embodiment.

FIG. 7 is a flowchart showing an automatic refresh process called by a timer interrupt in the present embodiment.

FIG. 8 is a configuration diagram of a conventional local area network system.

[Explanation of symbols]

 11, 12, 13, 14, 15 LAN 21, 22, 23, 24 Relay device 21a, 21b Port 21c Control unit 21d Relay control table 21e Alarm information notification unit 21f Alarm information notification condition registration unit 21g Access history information storage unit 51, 52, 53, 54, 55 Terminal device 56 Management device 56a Input / output unit 56b Control unit 56c Memory 56d Alarm information display unit 56e Access history information transmission request unit

─────────────────────────────────────────────────── ─── Continuation of the front page (51) Int.Cl. ⁶ Identification code Internal reference number FI Technical display location G06F 13/00 351 Z 7368-5B 15/00 330 A 7459-5L H04L 12/40

Claims (8)

[Claims] 1. A transmission medium for connecting a terminal device to which a unique address is allocated, a relay device for relaying communication of the terminal device pipe via the transmission medium, and a network connected to any one of the transmission media. In a security system that has a management device that manages a system and that allows communication between each permitted terminal device, the relay device is configured to connect to the terminal device on the transmission medium connected to the own relay device. A security method characterized in that alarm information is notified to the management device when an unauthorized access or failure is detected. 2. The security method according to claim 1, wherein the relay device has an alarm notification condition registration unit that registers a condition for notifying the alarm information. 3. The security method according to claim 1, wherein the management device has means for displaying the received alarm information. 4. The security method according to claim 1, wherein the management device records access status information of an arbitrary relay device via the transmission medium connected to the own relay device. A security method comprising means for requesting the transmission of the. 5. The security system according to claim 4, wherein the management device is connected to the terminal device that has made an unauthorized access based on the access history information and the alarm information received from the relay device. A security method comprising means for identifying the. 6. The security system according to claim 4, wherein the management device has means for identifying the terminal device from the alarm information received from the relay device. 7. The security system according to claim 1 or claim 3 or claim 6, wherein each management device is realized by the terminal device. 8. The security method according to claim 1, wherein the relay device determines whether to permit / prohibit the relay control of the received frame based on the set permission / prohibition information, and determines to prohibit the relay control. A security method that detects unauthorized access or failure based on the alarm information notification conditions that have been set.