Communication control apparatus and communication control method

Abstract

To defend against an attack from an unauthorized terminal in a system to which many switching hubs are connected.SOLUTION: The communication control device 1 is provided with an irregular terminal detection section 10 that detects irregular terminals connected to the network, a specification section 12 that, when an irregular terminal is detected, specifies the position of the irregular terminal on the network, the nearest switching hub connected to the irregular terminal, the nearest higher-level switching hub among the higher-level switching hubs connected to the nearest switching hub, and the port of the nearest higher-level switching hub connected to the nearest switching hub, and a connection cutoff section 13 that disables the ports of the nearest switching hub other than the port connected to the nearest higher-level switching hub, and disables the port of the nearest higher-level switching hub connected to the nearest switching hub.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a communication control device and a communication control method. [Background technology]

[0002] Large-scale network systems, such as central monitoring systems for buildings, are constructed by connecting multiple switching hubs. Switching hubs are often stored in locked control panels. However, an insider could unlock the hub and launch an attack from an open boat.

[0003] Conventionally, one example of a technology for defending against attacks from a network is the technology disclosed in Patent Document 1. However, the technology disclosed in Patent Document 1 defends by rewriting the routing map of a gateway, and is not intended for a network system in which many switching hubs are connected. Conventionally, no technology for a network system in which many switching hubs are connected has been known. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Publication No. 2021-163978 Summary of the Invention [Problem to be solved by the invention]

[0005] The present invention has been made to solve the above-mentioned problems, and aims to provide a communication control device and a communication control method that can defend against attacks from unauthorized terminals in a network system to which a large number of switching hubs are connected. [Means for solving the problem]

[0006] The communication control device of the present invention is characterized by comprising: an unauthorized terminal detection unit configured to detect an unauthorized terminal connected to a network; an identification unit configured to, when the unauthorized terminal is detected, identify the location of the unauthorized terminal on the network, the nearest switching hub connected to the unauthorized terminal, the nearest-higher-level switching hub among the higher-level switching hubs connected to the nearest switching hub, and the port of the nearest-higher-level switching hub connected to the nearest switching hub; and a connection blocking unit configured to disable ports of the nearest switching hub other than the port connected to the nearest-higher-level switching hub, and to disable the port of the nearest-higher-level switching hub connected to the nearest switching hub.

[0007] Furthermore, one configuration example of the communication control device of the present invention further includes a network configuration understanding unit configured to understand the configuration of the network, and the identification unit is characterized in that, based on the network configuration understood by the network configuration understanding unit, it identifies the location of the unauthorized terminal on the network, the nearest switching hub connected to the unauthorized terminal, the nearest-higher switching hub among the higher-level switching hubs connected to the nearest switching hub, and the port of the nearest-higher switching hub connected to the nearest switching hub. Furthermore, in one configuration example of the communication control device of the present invention, the identification unit is characterized in that it identifies the location of the unauthorized terminal on the network, the nearest switching hub connected to the unauthorized terminal, the nearest-higher switching hub among the higher-level switching hubs connected to the nearest switching hub, and the port of the nearest-higher switching hub connected to the nearest switching hub, based on the MAC address table of each switching hub on the network.

[0008] Furthermore, in one configuration example of the communication control device of the present invention, the identification unit is characterized in that, of the ports associated with the unauthorized terminal in the MAC address table of each switching hub on the network, the port with the fewest associated terminals is identified as the port to which the unauthorized terminal is connected, the switching hub having the identified port is identified as the nearest switching hub, the unit extracts switching hubs other than the nearest switching hub from the switching hubs associated with the port to which the device is registered in the MAC address table of the nearest switching hub, references the port to which the nearest switching hub is registered in the MAC address table of the extracted switching hub, identifies the extracted switching hub with the fewest switching hubs associated with this port as the nearest-higher-level switching hub, and identifies the port to which the nearest switching hub is registered in the MAC address table of the nearest-higher-level switching hub as the port to which the nearest switching hub is connected.

[0009] Furthermore, the communication control method of the present invention is characterized by including a first step of detecting an unauthorized terminal connected to a network; a second step of, when the unauthorized terminal is detected, identifying the location of the unauthorized terminal on the network, the nearest switching hub connected to the unauthorized terminal, the nearest-upper switching hub among the upper switching hubs connected to the nearest switching hub, and the port of the nearest-upper switching hub connected to the nearest switching hub; and a third step of disabling ports of the nearest switching hub other than the port connected to the nearest-upper switching hub, and disabling the port of the nearest-upper switching hub connected to the nearest switching hub. [Effects of the Invention]

[0010] According to the present invention, by providing an unauthorized terminal detection unit, an identification unit, and a connection blocking unit, it is possible to block a minimum number of points, including unauthorized terminals, from the network in a network system to which many switching hubs are connected, thereby allowing the system to continue operating.The present invention significantly reduces the possibility that an attacker using an unauthorized terminal will continue the attack by connecting another device to another port of the switching hub. [Brief explanation of the drawings]

[0011] [Figure 1] FIG. 1 is a block diagram showing the configuration of a communication control device according to an embodiment of the present invention. [Figure 2] FIG. 2 is a diagram showing an example of a network system in which a large number of switching hubs are connected. [Figure 3] FIG. 3 is a flowchart illustrating the operation of the communication control device according to the embodiment of the present invention. [Figure 4] FIG. 4 is a diagram showing an example of a MAC address table according to an embodiment of the present invention. [Figure 5] FIG. 5 is a schematic diagram illustrating the process of disabling a port of a switching hub according to an embodiment of the present invention. [Figure 6] FIG. 6 is a block diagram showing an example of the configuration of a computer that realizes a communication control device according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0012] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. Fig. 1 is a block diagram showing the configuration of a communication control device according to an embodiment of the present invention. The communication control device 1 includes an unauthorized terminal detection unit 10, a network configuration understanding unit 11, an identification unit 12, and a connection blocking unit 13.

[0013] Figure 2 shows an example of a network system in which many switching hubs are connected. In the example of Figure 2, port #4 of lower-level switching hub 2-B is connected to port #1 of switching hub 2-A. Terminal 3-K is connected to port #3 of switching hub 2-A. Switching hub 2-F is connected to port #5 of switching hub 2-A. Terminal 3-L is connected to port #7 of switching hub 2-A.

[0014] Switching hub 2-G is connected to port #1 of switching hub 2-B. Terminals 3-J and 3-O and port #3 of switching hub 2-C are connected to ports of switching hub 2-F. Terminal 3-H is connected to a port of switching hub 2-G. Port #1 of switching hub 2-C is connected to port #1. Port #2 of switching hub 2-D is connected to port #2 of switching hub 2-D. Terminal 3-Q is connected to port #7 of switching hub 2-D. Terminal 3-P is connected to port #7 of switching hub 2-E.

[0015] Of the switching hubs 2-A to 2-G, switching hubs 2-A to 2-E are SNMP (Simple Network Management Protocol) compatible switching hubs, while switching hubs 2-F and 2-G are SNMP non-compatible switching hubs. As will be described later, in this embodiment, the network configuration is determined using SNMP, so it is not possible to determine the connection ports of switching hubs that are not SNMP compatible.

[0016] In this embodiment, it is assumed that the functions of the communication control device 1 are implemented in the terminal 3-K. In this embodiment, the side on which the functions of the communication control device 1 are operating is the upper side, and the side farther from the communication control device 1 is the lower side.

[0017] 3 is a flowchart illustrating the operation of the communication control device 1. The unauthorized terminal detection unit 10 of the communication control device 1 detects an unauthorized terminal connected to the network (step S100 in FIG. 3). When the unauthorized terminal detection unit 10 detects an attack (e.g., a DoS (Denial of Service) attack, SQL injection, etc.) from a terminal connected to the network, it detects the attacking terminal as an unauthorized terminal. Furthermore, when a terminal connected to the network has a MAC (Media Access Control) address that does not match a known, recognized MAC address, the unauthorized terminal detection unit 10 detects this terminal as an unauthorized terminal.

[0018] When an unauthorized terminal is detected by the unauthorized terminal detection unit 10, the identification unit 12 of the communication control device 1 determines whether the network configuration has been grasped (step S101 in FIG. 3). If the network configuration has not been grasped, the network configuration is grasped by the network configuration grasping unit 11.

[0019] SNMP is one of the protocols responsible for monitoring and managing TCP (Transmission Control Protocol) / IP (Internet Protocol) network environments. By using a switching hub that supports SNMP, it is possible to obtain port information of the switching hub, etc. The network configuration understanding unit 11 understands the network configuration using this SNMP (step S102 in Figure 3). The technology for understanding the network configuration using SNMP is disclosed in Japanese Patent Application Laid-Open No. 2021-153247.

[0020] FIG. 4 shows MAC address tables 20-A to 20-E set in switching hubs 2-A to 2-E in the network system shown in FIG. 2. The MAC address tables associate MAC addresses with port numbers. Note that A, B, C, D, and E in MAC address tables 20-A to 20-E represent the MAC addresses of switching hubs 2-A, 2-B, 2-C, 2-D, and 2-E, respectively. H, J, K, L, O, P, and Q in MAC address tables 20-A to 20-E represent the MAC addresses of terminals 3-H, 3-J, 3-K, 3-L, 3-O, 3-P, and 3-Q. Network configuration understanding unit 11 can acquire such MAC address tables 20-A to 20-E and understand the network configuration.

[0021] Next, if the network configuration has been grasped by the network configuration grasping unit 11 or if the network configuration has already been grasped (YES in step S101), the identification unit 12 identifies the location on the network of the unauthorized terminal detected by the unauthorized terminal detection unit 10, the nearest SNMP-compatible switching hub that is directly or indirectly connected to the unauthorized terminal, the nearest SNMP-compatible switching hub among the upstream switching hubs that are directly or indirectly connected to this switching hub, and the port of the nearest SNMP-compatible switching hub that is connected to the nearest SNMP-compatible switching hub of the unauthorized terminal (step S103 in Figure 3).

[0022] The unauthorized terminal detection unit 10 notifies the identification unit 12 of the MAC address of the unauthorized terminal. Therefore, the identification unit 12 can identify the location of the unauthorized terminal on the network (the port of the switching hub to which the unauthorized terminal is connected). Specifically, the identification unit 12 refers to all the MAC address tables acquired by the network configuration understanding unit 11, and refers to the port of the switching hub in which the MAC address of the unauthorized terminal is registered. Of the ports associated with the MAC address of the unauthorized terminal in the MAC address table of each switching hub, the port with the fewest corresponding terminals is the port to which the unauthorized terminal is connected.

[0023] Assume that the unauthorized terminal is terminal 3-Q in Fig. 2. In the example of Fig. 4, the ports associated with the MAC address of unauthorized terminal 3-Q are port #5 of switching hub 2-A (address table 20-A), port #4 of switching hub 2-B (address table 20-B), port #1 of switching hub 2-C (address table 20-C), port #7 of switching hub 2-D (address table 20-D), and port #1 of switching hub 2-E (address table 20-E). Therefore, port #7 of switching hub 2-D is the port connected to unauthorized terminal 3-Q.

[0024] The unauthorized terminal is connected directly to an SNMP-compatible switching hub, or indirectly to an SNMP-compatible switching hub via a non-SNMP-compatible switching hub or the like. The identification unit 12 identifies the SNMP-compatible switching hub having the port connected to the unauthorized terminal, which was discovered in identifying the location of the unauthorized terminal, as the nearest SNMP-compatible switching hub. If the unauthorized terminal is terminal 3-Q, the nearest SNMP-compatible switching hub is 2-D.

[0025] Furthermore, the SNMP-compatible switching hub closest to the unauthorized terminal is directly connected to a higher-level SNMP-compatible switching hub, or is indirectly connected to the higher-level SNMP-compatible switching hub via an SNMP-incompatible switching hub, etc. The identification unit 12 identifies the SNMP-compatible switching hub closest to the SNMP-compatible switching hub closest to the unauthorized terminal.

[0026] Specifically, the identification unit 12 refers to the MAC address table of the switching hub closest to the unauthorized terminal, refers to the port in which the MAC address of its own device (a terminal in which the functions of the communication control device 1 are implemented, terminal 3-K in this embodiment) is registered, and extracts switching hubs other than the switching hub closest to the unauthorized terminal from among the switching hubs associated with the port. In the above example, in the MAC address table 20-D of the switching hub 2-D closest to the unauthorized terminal 3-Q, the port in which the MAC address of terminal 3-K is registered is #1. From among the switching hubs associated with this port #1, the switching hubs other than switching hub 2-D closest to the unauthorized terminal 3-Q are 2-A, 2-B, and 2-C.

[0027] Furthermore, the identifying unit 12 refers to the port in which the MAC address of the switching hub closest to the unauthorized terminal is registered in the MAC address table of the extracted switching hubs, and determines the extracted switching hub with the fewest switching hubs associated with that port as the switching hub immediately above the switching hub immediately above the unauthorized terminal.Furthermore, the identifying unit 12 determines the port in which the MAC address of the switching hub immediately above the unauthorized terminal is registered in the MAC address table of the switching hub immediately above the unauthorized terminal as the port to which the switching hub immediately above the unauthorized terminal is connected.

[0028] In the above example, in the MAC address table 20-A of switching hub 2-A after extraction, the port in which the MAC address of switching hub 2-D closest to unauthorized terminal 3-Q is registered is #5. In the MAC address table 20-B of switching hub 2-B after extraction, the port in which the MAC address of switching hub 2-D closest to unauthorized terminal 3-Q is registered is #4. In the MAC address table 20-C of switching hub 2-C after extraction, the port in which the MAC address of switching hub 2-D closest to unauthorized terminal 3-Q is registered is #1. Of port #5 of switching hub 2-A, port #4 of switching hub 2-B, and port #1 of switching hub 2-C, the fewest switching hubs are associated with port #1 of switching hub 2-C, so switching hub 2-C is the switching hub immediately upstream of switching hub 2-D closest to unauthorized terminal 3-Q. Also, port #1 of the switching hub 2-C is the port to which the switching hub 2-D closest to the unauthorized terminal 3-Q is connected.

[0029] The connection cutoff unit 13 disables the ports of the SNMP-compatible switching hub 2-D closest to the unauthorized terminal 3-Q except for the port connected to the SNMP-compatible switching hub 2-C, which is the closest higher-level port (step S104 in FIG. 3). The reason why the port connected to the SNMP-compatible switching hub 2-C, the closest higher-level port, is not disabled is because if it were disabled, it would become impossible to connect to the switching hub 2-D via the network, and it would be impossible to re-enable it. Furthermore, the connection cutoff unit 13 disables the port connected to the SNMP-compatible switching hub 2-D, among the ports of the SNMP-compatible switching hub 2-C, the closest higher-level port to the SNMP-compatible switching hub 2-D (step S105 in FIG. 3). In the example in FIG. 5, disabled ports are indicated by an "x" mark. That is, ports #2 to #7 of the SNMP-compatible switching hub 2-D are disabled, and further, port #1 of the SNMP-compatible switching hub 2-C is disabled. Disabling a port can be achieved, for example, by deleting the MAC addresses of the switching hub and terminal associated with that port in a MAC address table.

[0030] In this way, in this embodiment, the portion indicated by the dotted line 30 in FIG. 5 can be blocked from the network. In this embodiment, the minimum number of points, including the unauthorized terminal that is the source of the attack, are blocked from the network, allowing the system to continue operating. If the port where the attack was detected or only the unauthorized terminal is disabled, there is a possibility that an attacker using the unauthorized terminal could connect another device to a different port and continue the attack. According to this embodiment, the possibility of such an attack continuing can be significantly reduced.

[0031] The communication control device 1 described in this embodiment can be realized by a computer equipped with a CPU (Central Processing Unit), a storage device, and an interface, and a program that controls these hardware resources. An example of the configuration of this computer is shown in FIG.

[0032] The computer includes a CPU 200, a storage device 201, and an interface device (I / F) 202. A switching hub, a display device, etc. are connected to the I / F 202. In such a computer, a program for realizing the communication control method of the present invention is stored in the storage device 201. The CPU 200 executes the processing described in this embodiment in accordance with the program stored in the storage device 201. [Explanation of symbols]

[0033] 1...Communication control device, 2-A to 2-G...Switching hub, 3-H, 3-J, 3-K, 3-L, 3-O, 3-P, 3-Q...Terminal, 10...Unauthorized terminal detection unit, 11...Network configuration understanding unit, 12...Identification unit, 13...Connection blocking unit.

Claims

1. an unauthorized terminal detection unit configured to detect unauthorized terminals connected to the network; an identification unit configured to, when the unauthorized terminal is detected, identify the location of the unauthorized terminal on the network, the nearest switching hub connected to the unauthorized terminal, the nearest upper switching hub among upper switching hubs connected to the nearest switching hub, and the port of the nearest upper switching hub connected to the nearest switching hub; a connection interruption unit configured to disable ports of the nearest switching hub other than the port connected to the nearest higher-level switching hub, and to disable the port of the nearest higher-level switching hub that is connected to the nearest switching hub.

2. 2. The communication control device according to claim 1, a network configuration recognition unit configured to recognize the configuration of the network; A communication control device characterized in that the identification unit identifies the network location of the unauthorized terminal, the nearest switching hub connected to the unauthorized terminal, the nearest-higher switching hub among the higher-level switching hubs connected to the nearest switching hub, and the port of the nearest-higher switching hub connected to the nearest switching hub, based on the network configuration identified by the network configuration identification unit.

3. 2. The communication control device according to claim 1, The identification unit is characterized by identifying the network location of the unauthorized terminal, the nearest switching hub connected to the unauthorized terminal, the nearest higher-level switching hub among the higher-level switching hubs connected to the nearest switching hub, and the port of the nearest higher-level switching hub connected to the nearest switching hub based on the MAC address table of each switching hub on the network.

4. 4. The communication control device according to claim 3, the identification unit identifies the port with the fewest corresponding terminals among the ports associated with the unauthorized terminal in the MAC address table of each switching hub on the network as the port to which the unauthorized terminal is connected, identifies the switching hub having the identified port as the nearest switching hub, extracts switching hubs other than the nearest switching hub from the switching hubs associated with the port in which the device itself is registered in the MAC address table of the nearest switching hub, references the port in which the nearest switching hub is registered in the MAC address table of the extracted switching hub, identifies the extracted switching hub with the fewest corresponding switching hubs as the nearest higher-level switching hub, and identifies the port in which the nearest switching hub is registered in the MAC address table of the nearest higher-level switching hub as the port to which the nearest switching hub is connected.

5. a first step of detecting an unauthorized terminal connected to a network; a second step of, when the unauthorized terminal is detected, identifying the location of the unauthorized terminal on the network, the nearest switching hub connected to the unauthorized terminal, the nearest upper switching hub among upper switching hubs connected to the nearest switching hub, and the port of the nearest upper switching hub connected to the nearest switching hub; a third step of disabling ports of the nearest switching hub other than the port connected to the nearest higher-level switching hub, and disabling ports of the nearest higher-level switching hub that are connected to the nearest switching hub.

Images