Management device, management method, and management program

Abstract

To enable appropriate invalidation processing of ports to be performed efficiently.SOLUTION: A management device 100 manages a network device included in an IP network on the basis of the Simple Network Management Protocol (SNMP), a protocol for managing the IP network. The management device 100 identifies trunk routes connecting switching hubs among the network devices. The management device 100 disables ports of the network devices, excluding those related to the trunk routes.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] The present invention relates to a management device, a management method, and a management program. [Background technology]

[0002] With the publication of the Cyber-Physical Security Guidelines for Building Systems formulated by the Ministry of Economy, Trade and Industry and the spread of hacking news, interest in cybersecurity in building systems is increasing.

[0003] Managing ports on switching hubs is an effective security measure. For example, one known method is to disable unused ports to prevent hacking by malicious individuals who connect LAN (Local Area Network) cables to unused ports on a switching hub without permission.

[0004] However, when enabling or disabling a switching hub port, it is necessary to physically connect a dedicated console cable for configuration to each switching hub and change the settings of each port one by one from the command screen.As a result, in large-scale network systems such as building systems with many switching hubs, enabling or disabling a switching hub port requires a significant amount of work.

[0005] Therefore, a technique for efficiently disabling ports of a switching hub is known as a conventional technique. For example, a conventional technique is known in which a device connected to each port of a switch is identified, and if a device to which a unique identifier is not assigned is connected, the corresponding port is automatically disabled (see, for example, Patent Document 1). [Prior art documents] [Patent documents]

[0006] [Patent Document 1] Patent Publication No. 2021-192306 Summary of the Invention [Problem to be solved by the invention]

[0007] However, with the above-mentioned conventional technology, it may be difficult to efficiently perform appropriate port disablement processing. For example, with the conventional technology, it is not possible to simultaneously disable the affected ports in the event of a DoS (Denial of Service) attack, which is carried out by infecting legitimate devices with a computer virus, occurring at multiple locations. Furthermore, even if all ports are simultaneously disabled, if ports related to trunk routes connecting switching hubs are also disabled, subsequent recovery may become difficult, making efficient port disablement processing difficult. [Means for solving the problem]

[0008] Therefore, in order to solve the above-mentioned problems and achieve the objectives, the management device of the present invention is a management device that manages network devices included in an IP network based on SNMP (Simple Network Management Protocol), which is a protocol for managing IP networks, and is characterized by having an identification unit that identifies a trunk route connecting switching hubs among the network devices, and an invalidation unit that excludes ports of the network devices that are related to the trunk route and disables the ports. [Effects of the Invention]

[0009] The present invention has the effect of enabling appropriate port invalidation processing to be performed efficiently. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 1 is a diagram illustrating an overall picture of processing by a management device according to this embodiment. [Figure 2]FIG. 2 is a diagram illustrating an example of the configuration of a management device according to this embodiment. [Figure 3] FIG. 3 is a table diagram showing an example of network configuration information according to this embodiment. [Figure 4] FIG. 4 is a table showing an example of the invalidation conditions according to this embodiment. [Figure 5] FIG. 5 is a table showing an example of warning conditions according to this embodiment. [Figure 6] FIG. 6 is a table showing an example of the device status according to this embodiment. [Figure 7] FIG. 7 is a diagram showing an example of the identification process according to this embodiment. [Figure 8] FIG. 8 is a diagram showing an example of the invalidation process according to this embodiment. [Figure 9] FIG. 9 is a diagram showing an example of the invalidation process according to this embodiment. [Figure 10] FIG. 10 is a diagram showing an example of the invalidation process according to this embodiment. [Figure 11] FIG. 11 is a diagram showing an example of the invalidation process according to this embodiment. [Figure 12] FIG. 12 is a flowchart showing an example of a procedure for identifying a trunk route according to this embodiment. [Figure 13] FIG. 13 is a flowchart showing an example of the procedure of the invalidation process according to this embodiment. [Figure 14] FIG. 14 is a flowchart showing an example of a procedure for a warning process according to this embodiment. [Figure 15] FIG. 15 is a hardware configuration diagram showing an example of a computer that realizes the functions of various devices that constitute the management device according to this embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0011] Hereinafter, an embodiment (hereinafter, "embodiment") will be described with reference to the drawings. In the following description, common components are given the same reference numerals, and repeated description will be omitted. Furthermore, the description of the embodiment described below does not limit the management device, management method, and management program according to the present invention.

[0012] <Introduction> First, an introduction to this embodiment will be given. Fig. 1 is a diagram illustrating an overview of processing by a management device 100 according to this embodiment. The management device 100 shown in Fig. 1 is an example of a computer that provides a technology for disabling target ports related to paths other than trunk paths without blocking trunk paths connecting switching hubs.

[0013] (background) In the past, when enabling or disabling ports on a switching hub included in a network in a network management system such as a building system, it was necessary to configure each switching hub individually. However, in the case of a large-scale network, the number of switching hubs that make up the network may reach several hundred, and changing the settings of each switching hub one by one would require a huge amount of work.

[0014] (Reference technology) Therefore, a reference technology is known that identifies the devices connected to each port of a switching hub, and automatically disables the corresponding port if a device that does not have unique identification information assigned to it is connected.

[0015] However, the reference technology has a problem in efficiently disabling appropriate ports when legitimate communication devices are infected with computer viruses at multiple locations, resulting in a DoS attack or other such attack.

[0016] For example, in the case where a legitimate terminal device is infected with a computer virus as described above and a large number of packets are sent from that terminal device, the reference technology can prevent the entire network from being shut down by disabling the corresponding port when a preset threshold is exceeded. Furthermore, the reference technology also makes it possible to disable all ports of all switching hubs as an emergency measure when the situation requires urgency.

[0017] However, the above-mentioned reference technology cannot properly disable only the target port. Therefore, if the disablement process is performed carelessly, the reference technology has a problem in that it becomes difficult to restore the network afterwards.

[0018] Specifically, SNMP controls the operation of devices within a network via the trunk route that connects switching hubs (hereinafter referred to simply as the "trunk route"). Therefore, if the trunk route is disconnected, it becomes impossible to remotely control the network devices beyond that route.

[0019] Therefore, even when disabling ports through remote communication using protocols such as Telnet, which is a communication protocol used to operate servers, routers, and other devices in remote locations from a terminal on an IP network, the order in which ports are disabled must be taken into consideration.

[0020] However, when disabling a port on a switching hub, it is difficult to determine whether the port is connected to a terminal device such as a personal computer (PC) or control device, or to the switching hub itself, making it difficult to determine whether the port is related to a trunk route. In the situation described above, if all ports on multiple switching hubs are disabled to respond to an emergency such as a computer virus infection of a legitimate device, there is a possibility that ports related to the trunk route will also be disabled. Furthermore, simply disabling a port that has exceeded a threshold may lead to the blocking of the trunk route, thereby blocking normal packet communication that should otherwise continue.

[0021] Therefore, if all ports on all switching hubs are disabled without considering the order in which they are disabled, communication with the switching hubs connected beyond them may become impossible, making it impossible to enable or disable ports remotely. In that case, recovery work will require visiting each switching hub individually and enabling the ports, which will require a great deal of work.

[0022] (Overall Overview of Processing by Management Device 100) Therefore, in order to solve the above-mentioned problem, the management device 100 according to this embodiment identifies a route that corresponds to a trunk route, and blocks only the remaining ports excluding the trunk route.

[0023] 1, a description will now be given of a series of processing flows of the management device 100. The management device 100 shown in Fig. 1 is a device that manages network devices included in an IP network based on SNMP, which is a protocol for managing IP networks.

[0024] First, the management device 100 identifies trunk routes connecting switching hubs among the network devices included in the IP network ((1) in FIG. 1). For example, the management device 100 identifies the route between the network device 200 and the network device 201 ((1-1) in FIG. 1) and the route between the network device 201 and the network device 202 ((1-2) in FIG. 1) as trunk routes.

[0025] Next, the management device 100 disables the ports of the network devices, excluding the ports related to the identified trunk route ((2) in FIG. 1). For example, the management device 100 disables the ports related to the route (1-1) in FIG. 1 and the route (1-2) in FIG. 1, which are identified as trunk routes, and disables the ports related to the route ((2-1) in FIG. 1) connecting the network devices 200 and 300 and the port related to the route ((2-2) in FIG. 1) connecting the network devices 201 and 301.

[0026] In this way, the management device 100 according to this embodiment grasps trunk routes based on the network configuration that can be acquired in cooperation with an SNMP-compatible switching hub, excludes related ports from the targets of the disable process so as not to block the trunk route, and then blocks the target route (port). Therefore, the management device 100 has the effect of being able to efficiently perform the disable process of appropriate ports.

[0027] <Description of management device> Next, detailed functions of the management device 100 according to this embodiment will be described. Fig. 2 is a diagram showing an example of the configuration of the management device 100 according to this embodiment. As shown in Fig. 2, the management device 100 includes a communication unit 110, a storage unit 120, and a control unit 130.

[0028] The management device 100 also has an input unit (not shown) such as a keyboard or touch panel for accepting input from users, etc., and a display unit (not shown) such as a display or printer for displaying the results of information processing by the management device 100 to users, etc.

[0029] (Communication unit 110) The communication unit 110 outputs information about port invalidation to a terminal device or the like operated by a user who manages the management device 100, and performs communication related to input of network configuration information about the IP network from an external information processing device or the like. The communication unit 110 is realized by a network interface card (NIC) or the like. The communication unit 110 is connected to the network via a wired or wireless connection as necessary, and can transmit and receive information bidirectionally. For example, as shown in FIG. 2, the communication unit 110 realizes communication with a plurality of network devices 200.

[0030] (Storage unit 120) The storage unit 120 is realized by, for example, a semiconductor memory element such as a random access memory (RAM) or a flash memory, or a storage device such as a hard disk or an optical disk. The storage unit 120 stores data and programs used for various processes by the control unit 130. As shown in FIG. 2 , the storage unit 120 has a network configuration information storage unit 121, an invalidation condition storage unit 122, a warning condition storage unit 123, and a device status storage unit 124.

[0031] (Network configuration information storage unit 121) The network configuration information storage unit 121 stores network configuration information (hereinafter, sometimes simply referred to as "network configuration information") including information about the connection status and connection state of network devices included in the IP network that is managed by the management device 100. Specifically, the network configuration information storage unit 121 stores information such as the name, IP address, and MAC address of the network device in association with predetermined identification information, etc.

[0032] Here, an example of network configuration information stored in the network configuration information storage unit 121 will be described. Fig. 3 is a table diagram showing an example of network configuration information according to this embodiment. As shown in Fig. 3, the network configuration information storage unit 121 stores "No.", which is information identifying individual network configuration information, in association with a connected device, an IP address, and a MAC address.

[0033] The above-mentioned connected devices are information that indicates the names of devices included in an IP network. IP addresses are identification information used to identify devices on an IP network. MAC addresses are identification information that is uniquely assigned to devices within a network and used to identify network interfaces.

[0034] For example, switching hub #A, switching hub #B, and switching hub #C shown in Figure 3 are trunk devices that can acquire MAC address table information. Repeater hub #D and repeater hub #E are non-trunk devices that cannot acquire MAC address table information. PC #F, PC #G, PC #H, PC #I, and PC #J are specified devices connected to the network device.

[0035] Generally, network devices included in IP network devices are assigned IP addresses and MAC addresses. For example, as shown in Fig. 3, switching hub #A is assigned "192.168.1.10" and "XX:XX:XX:XX:XX:10", and switching hub #B is assigned "192.168.1.11" and "XX:XX:XX:XX:XX:11". The network configuration information storage unit 121 stores the above information in association with No. "1".

[0036] Also, for "PC#F" to "PC#J" shown in FIG. 3, similarly to "switching hub #A" to "switching hub #C", the network configuration information storage unit 121 associates the IP addresses and MAC addresses with "No" and stores them.

[0037] Note that a typical repeater hub does not have an IP address or a MAC address, so the network configuration information storage unit 121 stores repeater hub #D and repeater hub #E as devices that do not have an IP address or a MAC address.

[0038] (Invalidation condition storage unit 122) The invalidation condition storage unit 122 stores information related to trigger conditions for the invalidation unit 135 (described later) to invalidate a port of a target network device. Specifically, the invalidation condition storage unit 122 stores an "invalidation condition," which is a condition for invalidating a port, in association with "No," which is information identifying an individual invalidation condition.

[0039] Here, a description will be given of an example of the invalidation conditions stored in the invalidation condition storage unit 122. Fig. 4 is a table diagram showing an example of the invalidation conditions according to this embodiment.

[0040] For example, the invalidation condition storage unit 122 stores the invalidation condition “instruction from user” identified by No. “1.” The above-mentioned condition means that when the management device 100 receives an instruction such as “disable port XX of network device XX” from a user or the like who manages the management device 100, the management device 100 will disable port XX of the corresponding network device XX.

[0041] The invalidation condition storage unit 122 also stores the invalidation condition "communication volume exceeds a predetermined threshold" identified by No. "2." This condition means that if the communication volume related to a port of a managed network device exceeds a preset threshold, the management device 100 invalidates the corresponding port.

[0042] The invalidation condition storage unit 122 also stores the invalidation condition "occurrence of computer virus infection" identified by No. 3. The above condition means that if a managed network device or a legitimate device connected to the network device is determined to be infected with a computer virus or the like, the management device 100 will invalidate the corresponding port.

[0043] (Warning condition storage unit 123) The warning condition storage unit 123 stores information about trigger conditions for the warning unit 134, which will be described later, to issue a warning to the user. Specifically, the warning condition storage unit 123 stores "warning conditions," which are conditions for issuing a predetermined warning, in association with "No," which is information that identifies an individual warning condition.

[0044] Here, an example of the warning condition stored in the warning condition storage unit 123 will be described. Fig. 5 is a table diagram showing an example of the warning condition according to this embodiment.

[0045] 5, the warning condition storage unit 123 stores a warning condition "The network configuration related to the trunk route has changed" identified by No. "1." The above condition means that if a route related to the trunk route among the pre-stored network configurations has changed compared to the network configuration acquired before the execution of the invalidation process, a warning such as "The network configuration related to the trunk route has changed" is output to a user who manages the network.

[0046] (Device status storage unit 124) The device status storage unit 124 stores information (device status) relating to the state of a network device whose port is switched between enabled and disabled by the later-described disabling unit 135. Specifically, the device status storage unit 124 stores, in association with predetermined identification information, information such as the name of the target network device, a port number, a classification as to whether the port is related to a trunk route, and a state as to whether the port is disabled.

[0047] Here, we will explain the device status stored by the device status storage unit 124. Fig. 6 is a table diagram showing an example of the device status according to this embodiment. Specifically, the device status storage unit 124 stores "No.", which is identification information of an individual device status, in association with a connected device, a port, a route segment, and a port status.

[0048] The above-mentioned connection device is information that indicates the name of a network device included in an IP network. A port is an identification number of an opening provided in a switching hub or network hub for connecting a LAN cable, etc. The route category is information that identifies whether the route related to the target port is a "trunk route," which is a route connecting switching hubs, or a "non-trunk route," which is any other route. The port status is information that identifies whether the target port is enabled or disabled.

[0049] For example, the device status storage unit 124 stores, in association with each other, a connected device "switching hub #A" identified by No. "1," a port "1," a route category "main line route," and a port status "enabled." Similarly, the device status storage unit 124 stores, in association with each other, a connected device "switching hub #A" identified by No. "2 to 5," a port "2 to 5," a route category "non-main line route," and a port status "disabled."

[0050] That is, the device status memory unit 124 can store the status of a network device whose ports have been disabled by the disabling unit 135 described below, except for ports related to the trunk route, by associating the status of "enabled or disabled" with each individual port of the network device.

[0051] (control unit 130) The control unit 130 is realized by a processor, a micro processing unit (MPU), a central processing unit (CPU), or the like executing various programs stored in the storage unit 120 using a random access memory (RAM) as a work area. The control unit 130 is also realized by an integrated circuit (IC) such as an application specific integrated circuit (ASIC) or a field programmable gate array (FPGA). As shown in FIG. 2 , the control unit 130 includes a receiving unit 131, an identifying unit 132, a monitoring unit 133, a warning unit 134, and an invalidating unit 135.

[0052] (Reception Department 131) The reception unit 131 receives information used by the management device 100 to disable ports of network devices under management via the input unit and communication unit 110. Specifically, the reception unit 131 receives network configuration information of the IP network, disablement conditions, warning conditions, and the like input by an external information processing device, a user, or the like. Additionally, when the management device 100 collects network configuration information from network devices included in the IP network, the reception unit 131 receives the network configuration information.

[0053] (Specific Section 132) The identifying unit 132 identifies a trunk route connecting switching hubs among the network devices. Specifically, the identifying unit 132 uses network configuration information related to the network devices acquired in advance to identify, as the trunk route, a route connecting switching hubs from which MAC address table information used for packet forwarding control can be acquired.

[0054] An example of the identification process performed by the identification unit 132 will now be described with reference to the drawings. FIG. 7 is a diagram illustrating an example of the identification process according to this embodiment. FIG. 7 shows an IP network configured by network devices "switching hub #A," "switching hub #B," "switching hub #C," "repeater hub #D," and "repeater hub #E," and devices "PC #F," "PC #G," "PC #H," and "PC #I" connected to the network devices. Furthermore, the management device 100 is connected to switching hub #A, and manages the network devices included in the IP network based on network configuration information acquired in advance.

[0055] For example, switching hub #C is connected to port 1 of switching hub #A via its port 4. Repeater hub #D is connected to port 4 of switching hub #A via its port 1. Switching hub #B is connected to port 5 of repeater hub #D via its port 4. Repeater hub #E is connected to port 2 of switching hub #C via its port 4. PC #F is connected to port 5 of switching hub #B. PC #G is connected to port 2 of repeater hub #D. PC #H is connected to port 1 of repeater hub #E. PC #I is connected to port 5 of repeater hub #E.

[0056] 7, a path connecting switching hubs, such as between switching hub #A and switching hub #B, and between switching hub #A and switching hub #C, is a "trunk path" in this embodiment. Note that a trunk device, terminal trunk device, or intermediate trunk device is a switching hub that constitutes a trunk path.

[0057] The MAC address table information of switching hub #B includes information that associates both switching hub #A and switching hub #C with port 4. Note that the MAC address table information of switching hub #B described above refers to only the switching hubs in the network, excluding devices such as PCs. Switching hub #B also has port 4, to which all other trunk devices are associated. As a result, the identification unit 132 determines that no trunk devices are connected beyond switching hub #B and identifies switching hub #B as an end trunk device.

[0058] Similarly, the MAC address table information of switching hub #C includes information that associates both switching hub #A and switching hub #B with port 4. Note that the MAC address table information of switching hub #C described above refers to only the switching hubs in the network, excluding devices such as PCs. Switching hub #C also has port 4, to which all other trunk devices are associated. As a result, the identification unit 132 determines that no trunk devices are connected beyond switching hub #C and identifies switching hub #C as an end trunk device.

[0059] On the other hand, the MAC address table information of switching hub #A other than switching hub #B and switching hub #C identified as terminal trunk devices includes information that switches hub #B is associated with port 4 of switching hub #A and information that switches hub #C is associated with port 1 of switching hub #A.

[0060] Furthermore, switching hub #A has port 4, which is associated with only one terminal trunk device, switching hub #B, and port 1, which is associated with only one terminal trunk device, switching hub #C. As a result, identification unit 132 identifies switching hub #A as an intermediate trunk device connected to terminal trunk devices switching hub #B and switching hub #C.

[0061] From the above-described identification result, the identification unit 132 identifies that switching hub #B and switching hub #C, which are terminal trunk devices, each constitute a trunk route connected to switching hub #A, which is an intermediate trunk device. As a result, the identification unit 132 identifies trunk route L1, which connects switching hub #A and switching hub #C, in which port 1 of switching hub #A is connected to port 4 of switching hub #C. The identification unit 132 also identifies trunk route L2, which connects switching hub #A and switching hub #B, in which port 4 of switching hub #A is connected to port 4 of switching hub #B.

[0062] In this way, the identifying unit 132 identifies a route that corresponds to a trunk route using the network configuration information.

[0063] (Monitoring Department 133) The monitoring unit 133 monitors the status of ports of network devices to be managed. Specifically, the monitoring unit 133 monitors whether an event that satisfies the condition for execution of invalidation processing by the invalidation unit 135, which will be described later, occurs in a port of the network device to be managed.

[0064] For example, the monitoring unit 133 acquires the communication volume per unit time for each port of the network device. Then, when an event occurs in which the communication volume itself exceeds a predetermined threshold or an event in which the fluctuation range per unit time exceeds a predetermined threshold, the monitoring unit 133 outputs flag information of the event occurrence to the warning unit 134 or the invalidation unit 135 based on a preset condition.

[0065] For example, the monitoring unit 133 acquires the connection status of each port of the network device at predetermined intervals or in real time. Then, when an event occurs in which a physical or logical connection to a monitored port is disconnected, or when an event occurs in which a device different from the registered information is connected, the monitoring unit 133 outputs flag information of the event occurrence to the warning unit 134 or the invalidation unit 135 based on a preset condition.

[0066] (Warning part 134) When a preset warning condition is met, the warning unit 134 issues a predetermined warning to the user who manages the IP network via a terminal device operated by the user or a display unit or the like provided in the management device 100.

[0067] Specifically, the warning unit 134 acquires network configuration information configured by network devices. Next, the warning unit 134 compares the connection status of the trunk route identified based on the acquired network configuration information with the connection status of the trunk route related to the trunk route identified in advance by the identification unit 132. Then, when it is determined as a result of the comparison that a change has occurred in the connection status of the trunk route, the warning unit 134 outputs a predetermined warning.

[0068] An example of the issuance of a warning by the warning unit 134 will be described later with reference to FIG. 10, and therefore a detailed description thereof will be omitted here.

[0069] (Invalidation unit 135) The invalidation unit 135 disables ports of the network devices, excluding ports related to trunk routes. Specifically, when an event that satisfies a predetermined condition that is set in advance occurs (for example, when flag information indicating the occurrence of an event is received from the monitoring unit 133), the invalidation unit 135 selects a target port that corresponds to the disablement condition set in the predetermined condition. Then, the invalidation unit 135 disables the remaining ports, excluding ports related to trunk routes, from the selected target ports.

[0070] As an example of a specific means for enabling or disabling a port of a switching hub, which is a network device, the disabling unit 135 can control the enabling or disabling of each port of an SNMP-compatible switching hub based on SNMP (oid;1.3.6.1.2.1.2.2.1.7)ifadminstatus or the like.

[0071] (An example of invalidation processing by the management device 100) Next, an example of the process of disabling ports of managed network devices realized by the above-described management device 100 will be described with reference to Fig. 8 to Fig. 11. Fig. 8 to Fig. 11 are diagrams showing an example of the disabling process according to this embodiment.

[0072] 8 to 11 show an IP network made up of network devices "switching hub #A," "switching hub #B," "switching hub #C," "repeater hub #D," and "repeater hub #E," and devices "PC #F," "PC #G," "PC #H," and "PC #I" connected to the network devices. Management device 100 is connected to switching hub #A and manages the network devices included in the IP network based on network configuration information acquired in advance.

[0073] The connection status of the network devices and devices connected to the network devices is the same as in FIG. 7, so detailed description will be omitted in the following sections.

[0074] (First example: An example of invalidation processing based on user instructions) First, as a first example, "an example of a disabling process based on a user instruction" will be described with reference to Fig. 8. In the first example, when a user who is an administrator of an IP network recognizes that a predetermined event such as a failure has occurred in the target network, the management device 100 disables the corresponding port based on an instruction from the user.

[0075] In the first example shown in FIG. 8, the invalidation unit 135 invalidates, as target ports, ports other than those related to trunk routes from among candidate ports for invalidation processing determined based on an invalidation instruction from a user.

[0076] As shown in FIG. 8, the management device 100 receives an instruction from the user 10 to "disable the ports of switching hub #A, switching hub #B, switching hub #C, repeater hub #D, and repeater hub #E" ((1) in FIG. 8).

[0077] Upon receiving an instruction from the user, the management device 100 identifies trunk routes in the IP network to be managed. Specifically, the management device 100 identifies trunk route L1 connecting port 1 of switching hub #A and port 4 of switching hub #C, and trunk route L2 connecting port 4 of switching hub #A and port 4 of switching hub #C via repeater hub #D. The management device 100 can also identify the route connecting port 2 of switching hub #C and port 4 of repeater hub #E as trunk route L3. Note that the above-mentioned identification process may be performed in advance before receiving the instruction to disable.

[0078] Based on the above-mentioned identification results, the management device 100 excludes from the disablement process "ports 1 and 4" of switching hub #A, "port 4" of switching hub #B, "ports 2 and 4" of switching hub #C, "ports 1 and 5" of repeater hub #D, and "port 4" of repeater hub #E, which are related to trunk route L1, trunk route L2, and trunk route L3.

[0079] The management device 100 collectively disables all ports other than the ports related to the excluded trunk route (ports shaded in FIG. 8). For example, as shown in FIG. 8, the management device 100 disables "ports 2, 3, and 5" for switching hub #A, "ports 1, 2, 3, and 5" for switching hub #B, and "ports 1, 3, and 5" for switching hub #C.

[0080] Furthermore, the management device 100 disables "ports 2, 3, and 4" for repeater hub #D, and "ports 1, 2, 3, and 5" for repeater hub #E.

[0081] As described above, in the first example, the management device 100 can collectively disable all ports except for ports related to the trunk route based on a user's instruction to disable. Note that, although the first example describes an example of a process for collectively disabling applicable ports, even when the user specifies ports to be disabled, the management device 100 can disable only the applicable ports after excluding ports related to the trunk route.

[0082] (Second example: an example of invalidation processing based on a communication volume threshold) Next, as a second example, "an example of invalidation processing based on a communication volume threshold" will be described with reference to Fig. 9. The second example is an example in which, when communication from a legitimate device connected to a network device (switching hub or repeater hub) included in an IP network increases due to a computer virus infection, external hacking, or the like, the management device 100 invalidates the corresponding port to protect the network.

[0083] In the second example shown in FIG. 9, the invalidation unit 135 invalidates ports of the managed network devices whose traffic volume exceeds a predetermined threshold, excluding ports related to trunk routes.

[0084] As shown in Figure 9, assume that an increase in communication traffic occurs from legitimate devices "PC#F" and "PC#I" ((1-1) and (1-2) in Figure 9). As a result, communication traffic increases at port 5 of switching hub #B to which PC#F is connected and at port 5 of repeater hub #E to which PC#I is connected.

[0085] Here, the management device 100 monitors the traffic volume of each port of the network devices to be managed, and detects an increase in the traffic volume between port 5 of switching hub #B and port 5 of repeater hub #E. Specifically, when the traffic volume between port 5 of switching hub #B and port 5 of repeater hub #E exceeds a preset upper limit (threshold) of the traffic volume, the management device 100 determines that the traffic volume has increased beyond the normal range.

[0086] The management device 100, which has detected an increase in communication traffic, identifies trunk paths in the IP network to be managed, in the same manner as in the first example. Then, the management device 100 collectively disables all ports (ports shaded in FIG. 9) other than the ports related to the identified trunk paths L1 and L2, in the same manner as in the first example.

[0087] As described above, in the second example, when the traffic volume of a port to be monitored exceeds a preset traffic volume threshold, the management device 100 can collectively disable all ports except for ports related to the trunk path. Note that, in the second example, an example of the process of collectively disabling the relevant ports has been described, but even when the ports to be disabled have been specified in advance, the management device 100 can disable only the relevant ports, excluding ports related to the trunk path.

[0088] (Third example: An example of invalidation processing when the state of a legitimate device changes) Next, as a third example, "an example of the disablement process when the state of a legitimate device changes" will be described with reference to Fig. 10. The third example is an example in which, when a legitimate device connected to a network device (such as a switching hub or a repeater hub) included in an IP network is infected with a computer virus and the computer virus infection of the legitimate device is detected by a method other than the amount of communication, the management device 100 disables the corresponding port to protect the network.

[0089] In the third example shown in FIG. 10, the invalidation unit 135 invalidates, as target ports, ports to which network devices that have been subjected to malicious attacks are connected, excluding ports related to trunk routes.

[0090] As shown in FIG. 10, it is assumed that legitimate devices "PC#F" and "PC#I" are infected with a computer virus ((1-1) and (1-2) in FIG. 10).

[0091] Here, the management device 100 monitors the status of devices connected via each port of the network device being managed, and detects that PC#F connected to port 5 of switching hub #B and PC#I connected to port 5 of repeater hub #E have been infected with a computer virus.

[0092] Specifically, the management device 100 determines that the legitimate devices "PC#F" and "PC#I" are infected with a computer virus by using publicly known computer virus detection technology or technology that detects whether the monitored device is infected with a computer virus based on the behavior of the device using a machine learning model, etc.

[0093] The management device 100, which has detected that a legitimate device has been infected with a computer virus, identifies trunk paths in the IP network to be managed, in the same manner as in Example 1. Then, the management device 100 collectively disables all ports (ports shaded in FIG. 10) other than the ports related to the identified trunk paths L1 and L2, in the same manner as in Example 1.

[0094] As described above, in the third example, the management device 100 can disable all ports except those related to the trunk route in a single operation, even when a legitimate device is infected with a computer virus, in addition to when communication volume increases. Note that, although the third example describes an example of a process for disabling all relevant ports in a single operation, the management device 100 can disable only the relevant ports, excluding ports related to the trunk route, even when the ports to be disabled are specified in advance.

[0095] (Example 4: Warning processing when network configuration changes) Next, as a fourth example, "an example of warning processing when network configuration changes" will be described with reference to FIG.

[0096] The fourth example is an example in which, in order to prevent the connected devices to the ports related to the trunk route from being replaced after the network configuration information related to the IP network is obtained, the network configuration information is obtained again before the invalidation process is executed, and if a change is found in the network configuration, the management device 100 issues a warning.

[0097] In a fourth example, when the management device 100 detects the occurrence of an event such as a user instruction (first example), an increase in communication volume (second example), or a computer virus infection of a legitimate device (third example), the management device 100 newly acquires network configuration information of the IP network to be managed.

[0098] Next, the management device 100 uses the newly acquired network configuration information to identify trunk routes in the IP network to be managed, in the same manner as in the first example.

[0099] Here, port 1 of switching hub #A and port 4 of switching hub #C are originally connected as a trunk path, but the connection between these ports has been logically or physically disconnected by a malicious attacker or the like ((1) in FIG. 11). Then, as shown in FIG. 11, the management device 100 detects that port 1 of switching hub #A is connected to terminal device 400.

[0100] The management device 100 compares the information that "port 1 of switching hub #A and port 4 of switching hub #C are connected as a trunk path" based on the network configuration information acquired before the event was detected with the information that "port 1 of switching hub #A is connected to terminal device 400" identified after the event was detected. As a result, the management device 100 determines that the connection status of the trunk path has changed before and after the event was detected.

[0101] If the management device 100 determines that the connection status of the trunk route has changed, it issues a warning message to the IP network administrator, such as "A change has occurred in the connection status of the trunk route" ((2) in Figure 11).

[0102] As described above, in the fourth example, even if an unintended change occurs in the connection status of the trunk path, the management device 100 can more effectively disable the port by outputting a warning message to the administrator user before executing the disablement process.

[0103] (Processing Procedure) Next, a description will be given of the processing procedure performed by the management device 100 according to this embodiment. In this section, the processing performed by the management device 100 will be explained by dividing it into "processing for identifying trunk routes," "invalidation processing," and "warning processing."

[0104] First, the "processing for identifying trunk routes" performed by the management device 100 will be described with reference to Fig. 12. Fig. 12 is a flowchart showing an example of the procedure for the processing for identifying trunk routes according to this embodiment.

[0105] The receiving unit 131 receives network configuration information (S101). Next, the identifying unit 132 identifies a trunk route of the network using the network configuration information received by the receiving unit 131 (S102).

[0106] Here, the management device 100 continues the process until it has completed identifying the ports related to the trunk route for the network devices in the IP network to be managed (No in S103). Then, when it has completed identifying the ports related to the trunk route for the target network devices (Yes in S103), the management device 100 ends the process.

[0107] Next, the "invalidation process" performed by the management device 100 will be described with reference to Fig. 13. Fig. 13 is a flowchart showing an example of the procedure of the invalidation process according to this embodiment.

[0108] The monitoring unit 133 monitors the network devices to be managed (S201). The monitoring unit 133 continues monitoring the network devices to be monitored, waiting for the invalidation process until a situation that satisfies the invalidation condition occurs (No in S202).

[0109] If a situation occurs in which the invalidation condition is satisfied (Yes in S202), the invalidation unit 135 invalidates the target ports, excluding ports related to the trunk route (S203). Then, the management device 100 ends the process.

[0110] Next, the "warning process" performed by the management device 100 will be described with reference to Fig. 14. Fig. 14 is a flowchart showing an example of the procedure for the warning process according to this embodiment.

[0111] The monitoring unit 133 monitors the network devices to be managed (S301). Note that the monitoring unit 133 continues monitoring the network devices to be monitored, waiting for the invalidation process until a situation that satisfies the invalidation condition occurs (No in S302).

[0112] If a situation that satisfies the invalidation condition occurs (Yes in S302) and the condition for issuing a warning to the user is satisfied (Yes in S303), the warning unit 134 acquires network configuration information (S304).The warning unit 134 then compares the connection status of the trunk route specified by the previously acquired network configuration information with the connection status of the trunk route specified by the newly acquired network configuration information (S305).

[0113] If a predetermined change has occurred in the connection status of the trunk route identified by the newly acquired network configuration information (Yes in S306), the warning unit 134 issues a warning to the user (S307). If a predetermined change has not occurred in the connection status of the trunk route identified by the newly acquired network configuration information (No in S306), the management device 100 skips the step of S307.

[0114] On the other hand, if the conditions for issuing a warning to the user are not met (No in S303), the management device 100 skips steps S304 to S307 and ends the process.

[0115] (effect) Next, the effects achieved by the management device 100 according to this embodiment will be described. The identification unit 132 of the management device 100 according to this embodiment identifies trunk routes connecting switching hubs among the network devices. The disabling unit 135 of the management device 100 disables ports of the network devices, excluding ports related to the trunk routes.

[0116] Therefore, the management device 100 of this embodiment has the effect of enabling efficient and appropriate port disablement processing. Specifically, the management device 100 maintains communication with the SNMP-compatible switching hub by disabling other ports while leaving the trunk route enabled, and enables settings such as recovery to be performed without having to go to the location where each switching hub is installed.

[0117] The identifying unit 132 uses network configuration information related to network devices acquired in advance to identify, as a trunk route, a route connecting switching hubs from which MAC address table information used for packet forwarding control can be acquired.

[0118] In this way, the management device 100 can identify the trunk route connecting the switching hubs based on the network configuration information acquired in advance, which has the effect of enabling the management device 100 to exclude the identified trunk route and then disable the port for the target network device.

[0119] When an event that satisfies a predetermined condition occurs, the invalidation unit 135 selects a target port that corresponds to the invalidation condition set in the predetermined condition. Then, the invalidation unit 135 invalidates the remaining ports excluding ports related to trunk routes from the selected target ports. In this way, by setting the invalidation condition in advance, the management device 100 has the effect of being able to invalidate ports for target network devices after excluding identified trunk routes.

[0120] Specifically, the disabling unit 135 disables, as target ports, ports excluding ports related to trunk routes among candidate ports for the disablement process determined based on the disablement instruction from the user. Therefore, even when the management device 100 receives an instruction from the user to disable a port of a target network device, for example, the management device 100 can achieve the effect of enabling the execution of port disablement for the target network device after excluding the trunk route.

[0121] Specifically, the disabling unit 135 disables, as target ports, ports of the managed network devices whose communication volume exceeds a predetermined threshold, excluding ports related to trunk routes. Therefore, even when, for example, the communication volume of a port of a network device increases and there is a possibility that it may affect the entire network, the management device 100 can effectively disable ports of the target network devices after excluding ports related to trunk routes, without waiting for instructions from the user.

[0122] Specifically, the disabling unit 135 disables, as the target ports, ports connected to the network device that has been subjected to the malicious attack, excluding ports related to the trunk path. Therefore, even in a case where, for example, a legitimate device connected to the network device is infected with a computer virus, which may affect the entire network, the management device 100 can effectively disable the ports of the target network device after excluding the trunk path, without waiting for an instruction from the user.

[0123] The warning unit 134 acquires network configuration information configured by network devices. The warning unit 134 compares the connection status of the trunk route identified based on the acquired network configuration information with the connection status of the trunk route related to the trunk route identified in advance by the identification unit 132. Then, when it is determined as a result of the comparison that a change has occurred in the connection status of the trunk route, the warning unit outputs a predetermined warning.

[0124] In this way, the management device 100 can warn the user that the network configuration has changed, even if a malicious person who understands the network configuration has changed the network configuration in order to avoid port disablement by the management device 100. As a result, the management device 100 has the effect of being able to efficiently perform appropriate port disablement processing even when attacked by a malicious person.

[0125] The above-described technique for identifying a network configuration by the management device 100 makes it possible to grasp the network configuration even if not all network devices are SNMP-compatible switching hubs. Therefore, the management device 100 can identify trunk routes even when non-SNMP-compatible switching hubs are mixed, and can simultaneously disable ports excluding ports related to trunk routes.

[0126] Furthermore, in the past, it was difficult to automatically exclude trunk routes and disable only the target ports, so the target ports had to be specified manually.However, the management device 100 of this embodiment can automatically exclude the identified trunk routes and then disable only the target ports, thereby making it possible to reduce the labor or processing volume required for port specification and disablement processing.

[0127] <Modification> The following describes modified examples realized by the management device 100 according to this embodiment.

[0128] (Data, etc.) The names of the network devices, switching hubs, repeater hubs, PCs, trunk devices, intermediate trunk devices, terminal trunk devices, trunk paths, non-trunk paths, names of functional parts of the management device 100, steps, processes, names of steps or processes, etc. used in the description of the above embodiments are merely examples and can be changed as desired.

[0129] For example, the network configuration information storage unit 121 stores "No.", which is information for identifying individual network configuration information, in association with a connected device, an IP address, and a MAC address, but the present invention is not limited to this.

[0130] For example, the invalidation condition storage unit 122 stores an "invalidation condition" that is a condition for invalidating a port, in association with "No" that is information that identifies an individual invalidation condition, but is not limited to this.

[0131] For example, the warning condition storage unit 123 stores a "warning condition" that is a condition for issuing a predetermined warning in association with "No." that is information that identifies an individual warning condition, but is not limited to this.

[0132] For example, the device status storage unit 124 stores "No.", which is identification information of an individual device status, in association with a connected device, a port, a route segment, and a port status, but is not limited to this.

[0133] (Network configuration information) In the present embodiment, the management device 100 has been described as accepting network configuration information input by an external information processing device, a user, etc., but the present invention is not limited to this. For example, the management device 100 can use network configuration information acquired by the management device 100 itself from network devices, etc. included in the IP network that it manages, in the port disablement process of the target network device.

[0134] (Flowcharts, etc.) The steps in the flowcharts may be interchanged as long as there is no contradiction, and some steps may not be performed. In addition, conjunctions such as "next," "continue," "further," "at this time," and "on this occasion" used in the explanation of the flowcharts do not limit the order or timing of the execution of the processes in the flowcharts.

[0135] Furthermore, the above-described "processing for identifying trunk routes," "invalidation processing," and "warning processing" can be combined to the extent that there is no contradiction between them. For example, the management device 100 can execute the "processing for identifying trunk routes" and then execute the "invalidation processing." Furthermore, the management device 100 can execute the "warning processing" beforehand and then execute the "invalidation processing."

[0136] (others) Of the processes described in the above embodiments and variations, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically using known methods. In addition, the information, including the processing procedures, specific names, various data, and parameters shown in the above documents and drawings, can be changed as desired unless otherwise specified. For example, the various information shown in each drawing is not limited to the information shown.

[0137] Furthermore, the components of each device shown in the figure are conceptual functional components and do not necessarily have to be physically configured as shown in the figure. In other words, the specific form of distribution and integration of each device is not limited to that shown in the figure, and all or part of them can be functionally or physically distributed and integrated in any unit depending on various loads, usage conditions, etc.

[0138] The above-described components include those that can be easily imagined by a person skilled in the art, those that are substantially the same, and those that fall within the so-called equivalent range. Furthermore, the above-described embodiments and modifications can be combined as appropriate within the scope of not causing any contradiction in the processing content.

[0139] Furthermore, the above-mentioned "section, module, unit" can be read as "means" or "circuit," etc. For example, a control section can be read as control means or a control circuit.

[0140] Although some of the embodiments have been described in detail above with reference to the drawings, these are merely examples, and it is possible to implement the present embodiments in other forms that have undergone various modifications and improvements based on the knowledge of those skilled in the art, including the aspects described in the Disclosure of the Invention section.

[0141] <Hardware configuration> The management device 100 according to this embodiment is realized, for example, by a computer 1000 configured as shown in Fig. 15. Fig. 15 is a hardware configuration diagram showing an example of a computer that realizes the functions of various devices that make up the management device according to this embodiment. The computer 1000 has a configuration in which a CPU 1100, a RAM 1200, a ROM 1300, an auxiliary storage device 1400, a communication I / F (interface) 1500, and an input / output I / F (interface) 1600 are connected by a bus 1800.

[0142] The CPU 1100 operates and controls each unit based on a program stored in the ROM 1300 or the auxiliary storage device 1400. The ROM 1300 stores a boot program executed by the CPU 1100 when the computer 1000 starts up, programs that depend on the hardware of the computer 1000, and the like.

[0143] The auxiliary storage device 1400 stores programs executed by the CPU 1100, data used by the programs, etc. The communication I / F 1500 receives data from other devices via a predetermined communication network NW (including closed-area wireless communication in this embodiment) and sends it to the CPU 1100, and transmits data generated by the CPU 1100 to other devices via the predetermined communication network NW. The CPU 1100 controls output devices such as displays and printers, and input / output devices 1700 such as keyboards and mice, via the input / output I / F 1600. The CPU 1100 acquires data from the input / output devices 1700 via the input / output I / F 1600. The CPU 1100 also outputs generated data to the input / output devices 1700 via the input / output I / F 1600.

[0144] For example, when the computer 1000 functions as various devices according to the present embodiment, the CPU 1100 of the computer 1000 executes a program loaded onto the RAM 1200 to realize the functions of the control unit. [Explanation of symbols]

[0145] 100 Management device 110 Communications Department 120 Storage section 121 Network configuration information storage unit 122 Invalidation condition memory unit 123 Warning condition storage section 124 Device status memory unit 130 control section 131 Reception 132 Specific part 133 Monitoring Department 134 Warning section 135 Nullification Section

Claims

1. A management device that manages network devices included in an IP network based on SNMP (Simple Network Management Protocol), which is a protocol for managing an IP network, comprising: an identifying unit that identifies a trunk route connecting switching hubs among the network devices; a disabling unit that disables ports of the network device, excluding ports related to the trunk path; A management device comprising:

2. The identification unit using previously acquired network configuration information related to the network devices, a route connecting the switching hubs from which MAC address table information used for packet forwarding control can be acquired is identified as the trunk route; The management device according to claim 1 .

3. The invalidation unit When an event occurs that satisfies a predetermined condition, Selecting a target port that corresponds to the invalidation condition set in the predetermined condition, Disabling the remaining ports excluding the ports related to the trunk route from the selected target ports; The management device according to claim 1 .

4. The invalidation unit As the target ports, disable ports excluding ports related to the trunk route from among candidate ports for the disable process determined based on an instruction for disablement from a user.

4. The management device according to claim 3.

5. The invalidation unit Disabling ports of the network devices to be managed, the ports of which communication volume exceeds a predetermined threshold, excluding ports related to the trunk route, as the target ports; 4. The management device according to claim 3.

6. The invalidation unit Disabling ports, excluding ports related to the trunk route, from among ports to which the network device subjected to the malicious attack is connected as the target ports; 4. The management device according to claim 3.

7. acquiring configuration information of a network configured by the network devices; comparing a connection status of the trunk route identified based on the acquired configuration information of the network with a connection status of the trunk route related to the trunk route identified in advance by the identifying unit; a warning unit that outputs a predetermined warning when it is determined that a change has occurred in the connection status of the trunk route as a result of the comparison; 7. The management device according to claim 1, wherein the management device is a management device for managing a plurality of data.

8. A management method executed by a management device that manages network devices included in an IP network based on SNMP (Simple Network Management Protocol), which is a protocol for managing the IP network, comprising: a step of identifying a trunk route connecting switching hubs among the network devices; a disabling step of disabling ports of the network device, excluding ports related to the trunk route; A management method comprising:

9. A management program to be executed by a management device that manages network devices included in an IP network based on SNMP (Simple Network Management Protocol), which is a protocol for managing the IP network, comprising: a step of identifying a trunk route connecting switching hubs among the network devices; a disabling step of disabling ports of the network device, excluding ports related to the trunk route; A management program featuring:

Images