Management device, management system, management method, and program

Abstract

This contributes to distributing the load of UTM processing across multiple devices. [Solution] A management device that manages the priority of nodes connected to an integrated threat management device including multiple integrated threat management devices, indicating which integrated threat management device will preferentially perform integrated threat processing to protect the node from external threats. The management device quantifies the line speed of each of the multiple integrated threat management devices to generate a line speed score, quantifies the device load of each of the multiple integrated threat management devices to generate a device load score, counts the number of times each of the multiple integrated threat management devices has performed integrated threat processing, and generates an order indicating the priority of each of the multiple integrated threat management devices based on the generated line speed score, device load score, and number of times integrated threat processing has been performed.

Description

Technical Field

[0001] The present disclosure relates to a management device, a management system, a management method, and a program.

Background Art

[0002] Connected between a wide area network such as the Internet and nodes that can be the main bodies of information processing and data communication, such as one or more terminal devices, personal computers (PCs), and server devices within an organization such as a company, an integrated threat management (UTM) device that protects nodes within the organization from various threats such as computer viruses and unauthorized access is known. Also, a load distribution system that distributes loads among multiple servers and executes predetermined processing is known (Patent Document 1).

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] Note that each disclosure of the above prior art documents is incorporated herein by reference. The following analysis was made by the present inventors.

[0005] UTM devices, such as servers with UTM functionality, filter and analyze data transmitted through communication between a wide-area network (external) and nodes within an organization (internal). Furthermore, based on the results of this filtering and analysis, they perform processes (UTM processing) to protect internal nodes from external threats. Such threats include, for example, computer viruses, spam emails, malware, inappropriate access to web pages from inside to outside, unauthorized intrusions, and other malicious attacks and vulnerabilities that may result from the actions of internal users.

[0006] If the UTM processing load on a single UTM device is low, one UTM device can protect all internal nodes from threats. However, if the types of external threats increase, the processing to protect internal nodes becomes more complex, or the number of internal nodes increases, the UTM processing load on a single UTM device can become excessive, potentially leading to problems such as significant processing delays. In such cases, it is desirable to distribute the processing load across multiple servers or other devices.

[0007] In view of the above-mentioned problems, the purpose of this disclosure is to contribute to the distribution of the UTM processing load across multiple devices. [Means for solving the problem]

[0008] From a first perspective of this disclosure, a management device is provided which includes one or more processors and manages the priority of one or more nodes connected to one or more integrated threat management devices, each of which of the multiple integrated threat management devices takes priority in performing integrated threat processing to protect against external threats. The one or more processors are configured to quantify the line speed of each of the multiple integrated threat management devices included in any of the integrated threat management devices and generate a line speed score, quantify the device load of each of the multiple integrated threat management devices and generate a device load score, count the number of times each of the multiple integrated threat management devices has performed the integrated threat processing, and generate order information indicating the priority of each of the multiple integrated threat management devices based on the generated line speed score, device load score, and the number of times the integrated threat processing has been performed.

[0009] A second aspect of this disclosure provides a management system comprising one or more integrated threat management devices, a plurality of integrated threat management processing devices included in the one or more integrated threat management devices, one or more nodes connected to the plurality of integrated threat management processing devices included in the one or more integrated threat management devices, and a management device that manages the priority of which of the plurality of integrated threat management processing devices will preferentially perform integrated threat processing to protect the one or more nodes from external threats. The one or more processors of the management device are configured to quantify the line speed of each of the plurality of integrated threat management processing devices included in any of the integrated threat management devices to generate a line speed score, quantify the device load of each of the plurality of integrated threat management processing devices to generate a device load score, count the number of times each of the plurality of integrated threat management processing devices has performed the integrated threat processing, and generate an order indicating the priority of each of the plurality of integrated threat management processing devices based on the generated line speed score, device load score, and the number of times the integrated threat processing has been performed, and to perform a process to transmit to each of the plurality of integrated threat management processing devices.

[0010] A third perspective of this disclosure provides a management method for managing the priority of one or more nodes connected to one or more integrated threat management devices, which include a plurality of integrated threat management devices, to perform integrated threat processing to protect against external threats. The management method includes the steps of: quantifying the line speed of each of the plurality of integrated threat management devices included in any of the integrated threat management devices to generate a line speed score; quantifying the device load of each of the plurality of integrated threat management devices to generate a device load score; counting the number of times each of the plurality of integrated threat management devices has performed the integrated threat processing; and generating order information indicating the priority of each of the plurality of integrated threat management devices based on the generated line speed score, device load score, and the number of times the integrated threat processing has been performed.

[0011] A fourth perspective of this disclosure provides a program that runs on a management device which includes one or more processors and manages the priority of one or more nodes connected to one or more integrated threat management devices which include a plurality of integrated threat management devices, indicating which of the plurality of integrated threat management devices will preferentially perform integrated threat processing to protect against external threats. The program causes the one or more processors to execute a process of quantifying the line speed of each of the plurality of integrated threat management devices included in any of the integrated threat management devices and generating a line speed score; a process of quantifying the device load of each of the plurality of integrated threat management devices and generating a device load score; a process of counting the number of times each of the plurality of integrated threat management devices has performed the integrated threat processing; and a process of generating order information indicating the priority of each of the plurality of integrated threat management devices based on the generated line speed score, device load score, and the number of times the integrated threat processing has been performed. This program can be recorded on a computer-readable storage medium. The storage medium may be non-transitory, such as semiconductor memory, hard disks, magnetic recording media, or optical recording media. This disclosure can be embodied as a computer program product. [Effects of the Invention]

[0012] From each perspective of this disclosure, it is possible to contribute to the distribution of the UTM processing load across multiple devices. [Brief explanation of the drawing]

[0013] [Figure 1A] Figure 1A is a diagram illustrating an example of a schematic configuration of an information and communication system relating to the first perspective of this disclosure. [Figure 1B] Figure 1B is a diagram illustrating an example configuration of the information and communication system described herein. [Figure 1C] Figure 1C illustrates one example configuration of the management device shown in Figure 1B. [Figure 2A] Figure 2A is a diagram illustrating an example of UTM processing device information used for communication between the management device and the UTM processing device of the information and communication system shown in Figure 1B. [Figure 2B] Figure 2B is a diagram illustrating an example of the content of line speed information transmitted from the UTM processing unit included in the UTM device to the management device. [Figure 2C] Figure 2C is a diagram illustrating an example of the contents of device load information transmitted from the UTM processing unit included in the UTM device to the management device. [Figure 2D] Figure 2D illustrates an example of transmission and reception volume information sent from the UTM processing unit included in the UTM device to the management device. [Figure 2E] Figure 2E illustrates an example of the content of machine learning information stored in a machine learning information database. [Figure 2F] Figure 2F illustrates an example of the content of the line speed score information output by a machine learning device. [Figure 2G] Figure 2G illustrates an example of the content of the device load score information output by a machine learning device. [Figure 2H] Figure 2H illustrates an example of the content of selection information stored in the selection information database. [Figure 2I] FIG. 2I is a diagram illustrating an example of the content of control request information transmitted to a management device so that a UTM processing device that has received a data transmission request from a node receives load distribution control. [Figure 2J] FIG. 2J is a diagram illustrating an example of the content of threshold information preset for generating UTM selection information in a selection information providing device. [Figure 2K] FIG. 2K is a diagram illustrating an example of the content of UTM selection information returned to a UTM processing device that has requested load distribution control by a selection information providing device. [Figure 3] FIG. 3 is a diagram illustrating a configuration example of the UTM processing device shown in FIG. 1B. [Figure 4] FIG. 4 is a flowchart diagram illustrating an operation example (S10) of an information communication system. [Figure 5A] FIG. 5A is a communication sequence diagram illustrating an operation example (S20) of an information communication system when a UTM processing device included in a UTM device performs UTM processing with the priority illustrated in FIG. 2K. [Figure 5B] FIG. 5B is a communication sequence diagram illustrating an operation example (S24) of an information communication system when a UTM processing device included in a UTM device performs UTM processing with the priority illustrated in FIG. 2K. [Figure 5C] FIG. 5C is a communication sequence diagram illustrating an operation example (S25) of an information communication system when a UTM processing device included in a UTM device performs UTM processing with the priority illustrated in FIG. 2K. [Figure 6] FIG. 6 is a diagram illustrating a configuration example of the hardware of a computer that software-implements one or more components of an information communication system.

BEST MODE FOR CARRYING OUT THE INVENTION

[0014] An embodiment of the present disclosure will be described below with reference to the drawings. However, the present disclosure is not limited to the embodiments described below. In each drawing, the same or corresponding elements are appropriately denoted by the same reference numerals, and the same or corresponding processes and communications are appropriately denoted by the same reference numerals. Furthermore, it should be noted that the drawings are schematic. In addition, the connecting lines between blocks in the drawings and other references referred to in the following description include both bidirectional and unidirectional lines. Unidirectional arrows schematically indicate the flow of the main signal (data) and do not exclude bidirectionality. Also, in the embodiments described below, information and data are not strictly distinguished. Furthermore, the terms "greater than or equal to" and "greater than" or "faster" in relation to the judgment result of other numerical values ​​relative to a numerical value are not strictly distinguished and are substantially the same. Similarly, the terms "less than or equal to" and "less than," "less than," or "slower" in relation to other numerical values ​​relative to a numerical value are not strictly distinguished and are substantially the same. Furthermore, the terms "heavy" and "large" are not strictly distinguished, nor are the terms "light" and "small" strictly distinguished; these terms often have essentially the same meaning.

[0015] In the following explanation and diagrams, when it is not necessary to specify one of several possible components, such as "UTM processing device 50-1 to 50-m," the subscripts "-1" and "-m" may be omitted, and it may simply be written as "UTM processing device 50." Also, the subscript m indicates a number of 2 or more, and the subscript n simply indicates a number of 1 or more; however, not all subscripts n represent the same number. Furthermore, the following diagrams and tables only show components, communications, information, and processing related to UTM processing. Components, communications, information, and processing unrelated to UTM processing in the information communication system 1 are generally not shown, but may be included as needed.

[0016] Figure 1A is a diagram illustrating a schematic configuration of an information and communication system 1 relating to the first perspective of this disclosure. As shown in Figure 1A, the information and communication system 1 includes a management device 3. Next, the configuration of the information and communication system 1 relating to this disclosure will be described with reference to Figures 1B and 1C. Figure 1B is a diagram illustrating an example configuration of the information and communication system 1 relating to this disclosure. Figure 1C is a diagram illustrating an example configuration of the management device 3 shown in Figure 1B. As illustrated in Figure 1B, the information and communication system 1 includes a Unified Threat Management (UTM) device 5 and UTM devices 5-1 to 5-n that are connected to each other so as to be able to communicate data via a wide area network (WAN) 100 capable of data communication such as the Internet, VPN (Virtual Private Network), and mobile communication network. However, when the wide area network 100 (external) is the Internet or other network unsuitable for ownership by a natural person or legal entity, the wide area network 100 is connected to the management device 3 and UTM device 5, but is not included in the information and communication system 1.

[0017] Each UTM device 5-1 to 5-n includes a UTM processing unit 50-1 to 50-m that is connected to each other via a short-range communication line 52-1 to 52-m, such as a LAN (Local Area Network) and Wi-Fi (registered trademark), enabling them to communicate data with each other. Each UTM processing unit 50-1 to 50-m is connected to a terminal system 54-1 to 54-m via a short-range communication line 56-1 to 56-m, enabling them to communicate data with each other. The UTM device 5, UTM processing units 50-1 to 50-m, short-range communication lines 52-1 to 52-m, terminal systems 54-1 to 54-m, short-range communication lines 56-1 to 56-m, and nodes 58-1-1 to 58-mn are used in a specific organization, such as a company and a school.

[0018] In terminal systems 54-1 to 54-m, each of the short-range communication lines 56-1 to 56-m is connected to a node 58-1-1 to 58-mn (not shown in terminal systems 54-2 to 54-m). However, it is not necessary for each of the short-range communication lines 56-1 to 56-m to have a node 58 connected to it; it is sufficient if one or more of the short-range communication lines 56-1 to 56-m have one or more nodes 58 connected to them. In other words, it is sufficient if each of the UTM devices 5-1 to 5-n, which are a collection of UTM processing units 50-1 to 50-m, has one or more nodes 58 connected to it. In the following explanation, the case in which UTM device 5-1 has three UTM processing units 50-1 to 50-3 is used as a specific example (m=3 for the UTM processing unit 50 of UTM device 5-1). Furthermore, in the following explanation, the case in which nodes 58-1-1 to 58-1-n, 58-2-1 to 58-2-n, and 58-3-1 to 58-3-n are connected to UTM processing units 50-1 to 50-3 respectively is used as a specific example.

[0019] The information and communication system 1, through these components, allows the UTM processing units 50-1 to 50-m, included in the UTM devices 5-1 to 5-m, to distribute UTM processing for data transmitted between the wide-area network 100 and nodes 58-1-1 to 58-mn, according to the priority set in accordance with the control of the management device 3. Furthermore, in the information and communication system 1, nodes 58-1-1 to 58-mn are protected from threats from the wide-area network 100. The configuration and operation of the management device 3, UTM device 5-1, UTM processing units 50-1 to 50-3, and nodes 58-1-1 to 58-3-n will be described below. Therefore, for example, when simply referred to as "UTM processing unit 50-1," this refers to the UTM processing unit 50-1 included in the UTM device 5-1. However, it goes without saying that the other UTM devices 5-2 to 5-n and their UTM processing units 50-1 to 50-m and nodes 58-2 to 58-mn also have a similar configuration and perform similar operations as the UTM device 5-1, the UTM processing units 50-1 to 50-3 and nodes 58-1 to 58-3-n.

[0020] Next, the configuration and operation of the management device 3 will be described. As shown in Figure 1C, the management device 3 comprises a communication processing unit 300, a communication information collection unit 302, a machine learning information database (machine learning information DB; Database Base) 304, a device information database 306, a machine learning unit 308, a selection information database 310, and a selection information provision unit 312. As will be described later with reference to Figure 6, each component of the management device 3 and the UTM device 5 can be implemented as one or more programs or program modules executed on an OS (Operating System) running on a computer with one or more processors.

[0021] The management device 3 uses these components to learn from machine learning information about line speed, CPU usage, and the usage rate of the UTM processing unit 50 itself, indicating the data rate of the data input and output to the UTM processing unit 50. Furthermore, based on the results of the machine learning, the management device 3 generates a line speed score that quantifies the line speed of each of the UTM processing units 50-1 to 50-3 of the UTM device 5-1, and a device load score that quantifies the device load. Based on these generated scores, the management device 3 distributes the processing load among the UTM processing units 50-1 to 50-3 to perform UTM processing.

[0022] Figure 2A is a diagram illustrating an example of UTM processing device information stored in the device information database 306 of the management device 3 in the information communication system 1 shown in Figure 1B, and used for communication between the management device 3 and the UTM processing devices 50-1 to 50-3 of the UTM device 5-1. In the management device 3, the communication processing unit 300 uses the device information illustrated in Figure 2A to perform communication processing and data transmission / reception between each component of the management device 3 and the short-range communication line 52 via the wide-area network 100. The communication processing unit 300 also performs communication processing and data transmission / reception between each component of the management device 3 and the node 58 of the terminal system 54 via the wide-area network 100, the UTM device 5, and the short-range communication line 56. The contents of the UTM processing device information are set in the management device 3 by the operator before the information communication system 1 starts operation, and thereafter, whenever changes to the contents are necessary, they are updated automatically or in response to the operator's actions.

[0023] As illustrated in Figure 2A, each entry in the device information contains device information 1-1~ij~nm corresponding to the combination of UTM devices 5-1~5-n and UTM processing units 50-1~50-n, namely 50-1-1~50-1-3~50-nm. Note that i is an integer from 1 to n and represents one of the subscripts "-1" to "-n" of the UTM devices 5-1~5-n, and j is an integer from 1 to m and represents one of the subscripts "-1" to "-m" of the UTM processing units 50-1~50-m.

[0024] The following description pertains to the UTM device 5-1, the UTM processing units 50-1 to 50-3 included therein, and the terminal system 54, etc., where i means 1 unless otherwise specified. The device information ij includes UTM device identification information (UTM device ID (Identifier)) 5-i that uniquely identifies the UTM device 5-i, UTM processing unit IDi-j that uniquely identifies the UTM processing unit 50-j included in UTM device ID 5-i, and the MAC (Media Access Control) address (MACi-j), IP (Internet Protocol) address (IPi-j), and performance information (Fi-j) indicating the function of the UTM processing unit 50-j included in UTM device ID 5-i.

[0025] The MAC address MACi-j and IP address IPI-j are used for communication between the management device 3 and the UTM processing unit 50-j included in the UTM device 5-i, and for control between them. The performance information ij indicates whether the UTM processing unit 50-j included in the UTM device 5-i has the function to protect node 58, its organization, and its users from threats such as computer viruses, spam emails, and unauthorized intrusions, and is used as appropriate to protect node 58 from threats. In the following diagrams illustrating the information, "device information ij" refers to any one or more pieces of information included in the device information ij of the UTM processing unit 50-j included in the UTM device 5-i that is subject to load balancing by the management device 3, and which are relevant to the purpose of that information.

[0026] Figure 2B is a diagram illustrating an example of the content of line speed information transmitted from the UTM processing unit 50-j included in the UTM device 5-1 to the management device 3. Note that the information shown in Figures 2B to 2K is created for each of the UTM processing units 50-1 to 50-3 of the UTM device 5-1. Figure 2C is a diagram illustrating an example of the content of device load information transmitted from the UTM processing unit 50-j included in the UTM device 5-1 to the management device 3. Figure 2D is a diagram illustrating an example of transmission and reception volume information transmitted from the UTM processing unit 50-j included in the UTM device 5-1 to the management device 3. Figure 2E is a diagram illustrating an example of the content of machine learning information stored in the machine learning information database 304.

[0027] The device information database 306 stores device information (Figure 2A) and returns the stored device information in response to requests from the communication processing unit 300 and the communication information collection unit 302, etc. The communication information collection unit 302 collects line speed information, which is illustrated in Figure 2B, device load information, which is illustrated in Figure 2C, which is illustrated in the CPU usage rate and device usage rate of each of the UTM processing units 50-1 to 50-3, and transmission / reception volume information, which is illustrated in Figure 2D, from the UTM processing units 50-1 to 50-3 of the UTM device 5-1, at appropriate timings, for example, at regular intervals or according to operator operations. The communication information collection unit 302 stores this collected information in the machine learning information database 304 as machine learning information.

[0028] As shown in Figure 2B, the line speed information includes device information ij, uplink line speed information (first data rate) indicating the line speed (data rate) of data from the UTM processing unit 50-j of UTM device 5-1 to the wide area network 100 (uplink direction), and downlink line speed information (second data rate) indicating the line speed from the wide area network 100 to the UTM processing unit 50-j of UTM device 5-1 (downlink direction). Furthermore, as shown in Figure 2C, the device load information includes device information ij, CPU usage information and UTM usage information of the UTM processing unit 50-j. Furthermore, as shown in Figure 2D, the transmitted and received data information includes device information ij, received data information indicating the amount of data received by the UTM processing unit 50-j, and transmitted data information indicating the sum of the received and transmitted data amounts.

[0029] The UTM processing unit 50-j can be implemented by one or more programs or program modules executed by a computer. The CPU usage information of the UTM processing unit 50-j included in the UTM device 5-i indicates the ratio of the amount of processing actually performed by the processor to the maximum amount of processing that each processor (CPU: Central Processing Unit) or combination of a CPU and a DSP (Digital Signal Processor) in such a computer can normally perform. The CPU usage information can be obtained, for example, by the functions of an OS such as Windows® or Unix® running on the computer that implements the functions of the UTM processing unit 50-j. The UTM usage information is a ratio that shows how much computer resources are actually allocated to UTM processing to the maximum amount of computer resources that can be allocated to UTM-related processing in the UTM processing unit 50-j. When the UTM processing unit 50 performs only UTM processing, the value indicated by the device usage information is nothing more than a mathematical representation of the ratio of the amount of processing actually performed by the UTM processing unit 50-j to the maximum amount of processing that the UTM processing unit 50-j can normally perform.

[0030] The machine learning information database 304 sequentially stores the information collected by the management device 3 as described above, associating it with the device information ij, as illustrated in Figure 2E, and storing it as machine learning information. As indicated by the dotted lines (···) in Figure 2E, the machine learning information may also include arbitrary information other than the information collected by the communication information collection unit 302, such as information required for subsequent machine learning. The machine learning information database 304 outputs the stored machine learning information to the machine learning information database 304 in response to a request from the device information database 306. Furthermore, after outputting machine learning information to the device information database 306, the machine learning information database 304 deletes the outputted machine learning information and appropriately saves information required for subsequent machine learning.

[0031] Figure 2F is a diagram illustrating an example of the contents of the line speed score information output by the machine learning unit 308. Figure 2G is a diagram illustrating an example of the contents of the device load score information output by the machine learning unit 308. The machine learning unit 308 includes a first part and a second part (not shown). The first part performs machine learning on the uplink speed information and downlink speed information of the UTM processing unit 50-j, and the second part performs machine learning on the CPU usage information and UTM usage information. The first part of the machine learning unit 308 periodically reads machine learning information (Figure 2E) from the machine learning information database 304, and uses the uplink speed information and downlink speed information of the UTM processing unit 50-j contained in the read machine learning information as its principal components to perform machine learning using principal component analysis and generate a line speed score by converting it into a score that represents a single numerical value.

[0032] The first principal component obtained by machine learning using principal component analysis on the uplink speed information and downlink speed information by the first part of the machine learning unit 308 is defined as the line speed score. Alternatively, instead of the first part of the machine learning unit 308 reading machine learning information from the machine learning information database 304, the machine learning information database 304 may output machine learning information to the first part of the machine learning unit 308 periodically, or whenever machine learning information is generated. Alternatively, the UTM processing unit 50-j may output machine learning information directly to the first part of the machine learning unit 308 without going through the machine learning information database 304. The higher the line speed score, the faster the uplink and downlink speeds of the UTM processing unit 50-j. The first part of the machine learning unit 308 may also perform machine learning on information that includes received data and transmitted data in addition to the uplink speed information and downlink speed information.

[0033] Furthermore, the second part of the machine learning unit 308 performs machine learning using principal component analysis, using the CPU usage information and UTM usage information of the UTM processing unit 50-j, which are periodically read from the machine learning information database 304, as principal components. This machine learning process generates a device load score by converting the data into a single numerical value. The first principal component obtained by the machine learning process using principal component analysis on the CPU usage information and UTM usage information by the second part of the machine learning unit 308 is considered the device load score. Alternatively, instead of the second part of the machine learning unit 308 reading machine learning information from the machine learning information database 304, the machine learning information database 304 may output machine learning information to the second part of the machine learning unit 308 periodically, or whenever machine learning information is generated. Alternatively, the UTM processing unit 50-j may directly output machine learning information to the second part of the machine learning unit 308 without going through the machine learning information database 304.

[0034] Note that the first and second parts of the machine learning unit 308 do not initially perform machine learning on machine learning information read from the machine learning information database 304 to generate line speed scores and device load scores. Before actually generating the line speed scores that will be used for priority management, the first part of the machine learning unit 308 performs preliminary learning by performing machine learning using principal component analysis on the uplink speed information and downlink speed information to generate a predetermined amount or more of line speed scores that will not be used for priority management. After this preliminary learning, the first part of the machine learning unit 308 generates the line speed scores that will actually be used for priority management based on the results of machine learning on the machine learning information.

[0035] Similarly, the second part of the machine learning unit 308 also performs preliminary learning by performing principal component analysis on CPU usage information and UTM usage information to generate a predetermined amount or more of device load scores that are not used for priority management, before actually generating the device load scores that are actually used for priority management. After this preliminary learning, the first part of the machine learning unit 308 generates the device load scores that are actually used for priority management based on the results of machine learning on the machine learning information. Note that the algorithms and calculation methods used by the first and second parts of the machine learning unit 308 to perform machine learning will vary depending on what specific machine learning information was used in the preliminary learning.

[0036] The higher the device load score, the higher (heavier) the CPU and UTM processing load. The second part of the machine learning unit 308 may perform machine learning on information that includes CPU usage information, UTM usage information, and UTM selection count information (see Figure 2H, described later). The machine learning unit 308 sequentially updates the contents of the selection information database 310 using the generated line speed score information and device load score information.

[0037] Figure 2H is a diagram illustrating an example of the content of selection information stored in the selection information database 310. As shown in Figure 2H, the selection information database 310 associates the device information ij of the UTM processing unit 50-j, the line speed score information and device load score information input from the machine learning unit 308, and the UTM selection count information, and stores them as selection information. The UTM selection count information is generated by the selection information provision unit 312 counting the number of times each UTM processing unit 50 included in the UTM device 5 has been selected as the UTM processing unit 50 that performs UTM processing in the UTM device 5. Figure 2H also shows a specific example where the numerical value of the UTM selection count information for each UTM processing unit 50-1 to 50-3 is between 0 and 2.

[0038] In other words, the UTM selection count information is the number of times each UTM processing unit 50 included in the UTM device 5 has performed UTM processing. As shown by the dotted lines (···) in Figure 2H, the selection information may include other information as appropriate. There may be multiple UTM processing units 50 in a single UTM device 5 that should be selected based on the line speed score information and the device load score information. In such cases, the UTM selection count information is used to select the UTM processing unit 50 corresponding to the UTM selection count information with a smaller numerical value as a higher priority for UTM processing, and to select the UTM processing unit 50 corresponding to the UTM selection count information with a larger numerical value as a lower priority for UTM processing later. The selection information database 310 returns the stored selection information in response to a request from the selection information provision unit 312. Furthermore, when the selection information database 310 outputs selection information to the selection information provision unit 312, it deletes the outputted selection information and appropriately saves the information necessary for the subsequent selection of the UTM processing unit 50.

[0039] Figure 2I illustrates an example of the content of control request information that a UTM processing unit 50-j, which is connected to a UTM device 5-i and receives a data transmission request from node 58-ij via a short-range communication line 56-j, transmits to the management device 3 in order to receive load balancing control.

[0040] Figure 2J illustrates an example of the content of threshold information pre-set in the selection information provision unit 312 for generating UTM selection information. Figure 2K illustrates an example of the content of UTM selection information returned by the selection information provision unit 312 to the UTM processing unit 50-j that requested load balancing control. In Figure 2K, as an example, among the UTM processing units 50-1 to 50-3 included in UTM device 5-1, the numerical value of the sequence information of UTM processing unit 50-1 is set to the highest value of 1, the numerical value of the sequence information of UTM processing unit 502 is set to the middle value of 2, and the numerical value of the sequence information of UTM processing unit 50-3 is set to the lowest value of 3. In other words, this sequence information indicates the priority order in UTM device 5-1, showing which of the UTM processing units 50-1 to 50-3 will protect node 58 from threats first. The management device 3 manages this priority order.

[0041] The selection information provision unit 312 receives control request information from the UTM processing unit 50-j, which has received a data transmission request from node 58-ij, as illustrated in Figure 2I. This information includes the device information ij of the UTM processing unit 50-j, the line speed score information, and the device load score information of the UTM processing unit 50-j. For example, a higher line speed score indicates a faster line speed of the UTM processing unit 50. Similarly, a higher device load score indicates a heavier UTM processing load on the UTM processing unit 50. The threshold information (Figure 2J) includes the device information ij of the UTM processing unit 50-j, line speed score threshold information indicating a threshold for the line speed score information, and device load score threshold information indicating a threshold for the device load score information. The threshold information is set for the management device 3 when the management device 3 starts operation and may be updated, for example, each time an additional UTM processing unit 50 is added. The line speed score threshold information and device load score information each indicate one type of threshold. Alternatively, when the sequence information of the UTM processing unit 50 can take on multiple types of numerical values, the line speed score threshold information and the device load score information indicate multiple types of thresholds corresponding to each of the multiple types of numerical values.

[0042] The selection information provision unit 312 processes the line speed score information and device load score information included in the control request information, and the threshold information set in the management device 3 by the operator or the like before the information communication system 1 starts operation, as shown in Figure 2J. Specifically, the selection information provision unit 312 compares the line speed score with the threshold indicated by the line speed score threshold information and performs a process to set the numerical value of the sequence information so that, for example, a UTM processing device 50 whose line speed score is greater than the numerical value indicated by the line speed score threshold information is more likely to be selected for UTM processing. The selection information provision unit 312 also compares the device load score with the threshold indicated by the device load score threshold information and performs a process to set the numerical value of the sequence information so that, for example, a UTM processing device 50 whose device load score is smaller than the numerical value indicated by the device load score threshold information is more likely to be selected for UTM processing.

[0043] As a result of this process, the selection information providing unit 312 generates selection information, as shown in Figure 2K, which includes sequence information indicating which UTM processing devices 50-1 to 50-3 should be used for UTM processing, and the line speed score, device load score, and UTM selection count information for each of the UTM processing devices 50-1 to 50-3. The sequence information is indicated by numerical values ​​such as 1, 2, 3, etc., and the smaller the number, the more preferentially it should be used for UTM processing. Numerical values ​​of sequence information for UTM processing devices 50 that are not included in the selection information, or numerical values ​​of sequence information for UTM processing devices 50 that cannot be used for UTM processing due to failure or other reasons, are represented by non-existent numbers such as -1. The selection information providing unit 312 transmits the generated selection information to the UTM processing device 50-j that sent the control request signal via the communication processing unit 300.

[0044] If the UTM processing unit 50-j that sent the control request signal has the smallest numerical value of the sequence information of the UTM processing unit 50-j indicated in the selection information, the UTM processing unit 50-j itself performs UTM processing on the data transmitted between node 58-ij and the wide area network 100. On the other hand, if the UTM processing unit 50-j that sent the control request signal does not have the smallest numerical value of the sequence information of the UTM processing unit 50-j indicated in the selection information, it requests the UTM processing unit 50 with the smallest sequence information among the UTM processing units 50 included in UTM device 5-i to perform UTM processing on the data transmitted between node 58-ij and the wide area network 100 via the short-range communication line 52.

[0045] Next, the configuration and operation of the UTM processing unit 50 will be described. Figure 3 is a diagram illustrating one example configuration of the UTM processing unit 50 shown in Figure 1B. As shown in Figure 3, the UTM processing unit 50 includes a network communication processing unit 500, a UTM processing unit 502, a terminal communication processing unit 504, a UTM selection information acquisition unit 506, a selection unit 508, a UTM unit interface (UTM unit IF (InterFace)) 510, and a control request unit 512.

[0046] When data transmission between node 58 and the wide area network 100 begins, the UTM processing unit 50 transmits control request information (Figure 2I) to the management device 3 via the wide area network 100, and receives UTM selection information (Figure 2K) transmitted by the management device 3 in response to this control request information. If the UTM processing unit 50 receives the received UTM selection information and the value of its own sequence information is the highest, for example, 1, the UTM processing unit 50 performs UTM processing itself to protect node 58 and its users from threats from the wide area network 100. On the other hand, if the UTM processing unit 50 receives the received UTM selection information and the value of the sequence information of another UTM processing unit 50 is higher than the value of its own sequence information, the UTM processing unit 50 causes the other UTM processing unit 50 to perform UTM processing to protect node 58 and its users from threats from the wide area network 100.

[0047] In the UTM processing unit 50, the network communication processing unit 500 performs communication processing and data transmission / reception with each component of the UTM processing unit 50 and the wide area network 100 via the short-range communication line 56. This communication processing is performed using information included in the device information ik (Figure 2A), which is set when node 58 starts up and is necessary for the UTM processing unit 50 to communicate with the wide area network 100. Furthermore, when the network communication processing unit 500 receives control request information (Figure 2I) from the control request unit 512, it transmits the received control request information to the management device 3 via the wide area network 100.

[0048] Furthermore, the network communication processing unit 500 generates transmission volume information, for example, at regular intervals, which shows the sum of the amount of data transmitted to the wide-area network 100 and the amount of data received from the wide-area network 100, and transmits this information to the management device 3 via the wide-area network 100. Also, the network communication processing unit 500 measures the line speed of the data transmitted from node 58 to the wide-area network 100 at regular intervals, and generates uplink speed information based on the results of this measurement. Also, the network communication processing unit 500 measures the line speed of the data transmitted from the wide-area network 100 to node 58 at regular intervals, and generates downlink speed information based on the results of this measurement. The network communication processing unit 500 transmits the generated uplink speed information and downlink speed information to the management device 3 via the wide-area network 100. Furthermore, the network communication processing unit 500 measures, for example, the CPU usage rate of the UTM processing unit 50 (described later with reference to Figure 6) and the processing load of the UTM processing unit 502 at regular intervals, generates CPU usage rate information and device load information based on these measurement results and UTM selection count information, and transmits them to the management device 3 via the wide area network 100.

[0049] When data transmission between the wide-area network 100 and node 58 via short-range communication lines 52 and 56 begins, the UTM processing unit 502 controls the control request unit 512 to generate control request information (Figure 2I) and receives the generated control request information from the control request unit 512. The UTM processing unit 502 outputs the received control request information to the management device 3 via the network communication processing unit 500 and the wide-area network 100. Furthermore, when the UTM processing unit 502 receives UTM request information from another UTM processing unit 50 included in the UTM device 5 via the short-range communication line 52 and the UTM unit IF 510, it performs UTM processing on behalf of the other UTM processing unit 50 that sent the UTM request information. The control request unit 512 generates control request information according to the control of the UTM processing unit 502 and outputs the generated control request information to the network communication processing unit 500.

[0050] When the UTM processing unit 50, which includes this unit, performs UTM processing on the data input from the network communication processing unit 500 and transmitted from the wide area network 100 to node 58, the UTM processing unit 502 performs UTM processing on the data input from the network communication processing unit 500 and transmitted from the UTM device 5 to the wide area network 100. If it determines that there is no threat in this data, it outputs this data to the terminal communication processing unit 504. In this case, the UTM processing unit 502 also outputs the data input from the terminal communication processing unit 504 and transmitted from the UTM device 5 to the wide area network 100 to the network communication processing unit 500.

[0051] Furthermore, if a UTM processing unit 50 other than the one included in the UTM device 5 performs UTM processing, the UTM processing unit 502 outputs data input from the network communication processing unit 500 and transmitted from the wide area network 100 to node 58 to the UTM unit IF 510. In this case, the UTM processing unit IF 510 outputs data input from node 58 to the wide area network 100 to the network communication processing unit 500.

[0052] The terminal communication processing unit 504 performs interface processing for sending and receiving data between each component of the UTM processing unit 50, including itself, and the node 58 via the short-range communication line 56. The UTM unit IF 510 performs interface processing for sending and receiving data between the UTM processing unit 50, including itself, and other UTM processing units 50 included in the UTM device 5 via the short-range communication line 52.

[0053] The UTM selection information acquisition unit 506 acquires UTM selection information (Figure 2K) from the data transmitted from the wide area network 100 to node 58 via the network communication processing unit 500 when the data contains UTM selection information. The UTM selection information acquisition unit 506 outputs the acquired UTM selection information to the selection unit 508.

[0054] The selection unit 508 processes the UTM selection information input from the UTM selection information acquisition unit 506 and determines whether the UTM processing unit 50 that includes this selection will perform UTM processing, or whether another UTM processing unit 50 among the UTM processing units 50 included in the UTM device 5 will perform UTM processing. If the selection unit 508 determines that another UTM processing unit 50 will perform UTM processing, it transmits UTM request information (not shown) to the other UTM processing unit 50 via the UTM unit IF 510 and the short-range communication line 52 to request UTM processing. Furthermore, if the selection unit 508 determines that the UTM processing unit 50 that includes this selection will perform UTM processing, it controls the UTM processing unit 502 to perform UTM processing on the data transmitted from the wide-area network 100 to node 58.

[0055] Next, the operation of the information communication system 1 will be explained with reference to Figure 4. Figure 4 is a flowchart illustrating one example of operation (S10) of the information communication system 1. In Figure 4, the operation of the management device 3 and the UTM processing device 50 in the information communication system 1 (Figure 1B) is mainly shown. As shown in Figure 4, in S100, the communication processing unit 300 of the management device 3 (Figure 1C) appropriately uses the information contained in the UTM processing device information (Figure 2A) to send and receive data between the UTM processing devices 50-1 to 50-3 of the UTM device 5-1 via the wide area network 100.

[0056] The network communication processing unit 500 (Figure 3) of the UTM processing units 50-1 to 50-3 included in the UTM device 5-1 also transmits and receives data with the management device 3 via the wide-area network 100, similar to the communication processing unit 300. Similarly, the terminal communication processing unit 504 of the UTM processing units 50-1 to 50-3 also transmits and receives data with nodes 58-1-1 to 58-1-n via the short-range communication line 56, similar to the communication processing unit 300 and the network communication processing unit 500. Furthermore, the UTM unit IF 510 of the UTM processing units 50-1 to 50-3 transmits data via the short-range communication line 52-1 to 52-3 to any UTM processing unit 50 other than the UTM processing units 50-1 to 50-3 in which it is included.

[0057] In S102, the communication information collection unit 302 of the management device 3 determines whether it has received at least one piece of information included in the machine learning information (Figure 2E) from at least one of the UTM processing devices 50-1 to 50-3 in the data input from the communication processing unit 300. The information communication system 1 proceeds to process S104 if it has received at least one piece of line speed information and device load information from at least one of the UTM processing devices 50-1 to 50-3 (YES in the process of S102), and proceeds to process S110 if it has not received anything (NO in the process of S102). In addition, as described above, the machine learning unit 308 may perform machine learning on information that adds received amount information and transmitted amount information to the line speed information. In this case, the machine learning unit 308 determines whether it has received at least one piece of uplink line speed information, downlink line speed information, received amount information, and transmitted amount information line speed information, and decides whether to proceed to process S104 or S110.

[0058] In S104, the communication information collection unit 302 generates machine learning information (Figure 2E) using the information contained in the machine learning information, and updates the contents of the machine learning information database 304 with the generated machine learning information. The machine learning unit 308 then performs machine learning using the information contained in the updated machine learning information and generates at least one of the line speed score information and device load score information (Figure 2F, Figure 2G). In S106, the machine learning unit 308 updates the selection information (Figure 2H) stored in the selection information database 310 with at least one of the line speed score information and device load score information generated in the processing of S104, and terminates the process.

[0059] In S110, the selection information provision unit 312 of the management device 3 determines whether or not it has received control request information (Figure 2I) from at least one of the UTM processing devices 50-1 to 50-3. If it has received control request information (Figure 2I) (YES in the processing of S110), the information communication system 1 proceeds to the processing of S112; if it has not received it (NO in the processing of S110), the information communication system 1 terminates processing. In S112, the selection information provision unit 312 obtains selection information (Figure 2H; information associated with device information 1-1 to 1-3) corresponding to the UTM processing devices 50-1 to 50-3 included in the UTM device 5-1.

[0060] In S114, the selection information provision unit 312 compares the numerical values ​​of the device load scores included in the selection information obtained in the S112 process with the device load score thresholds included in the threshold information (Figure 2J). The information communication system 1 proceeds to the S130 process if all the numerical values ​​of the device load scores included in the selection information are smaller than the device load score threshold (first threshold) (YES in the S114 process), and to the S116 process if they are not smaller (NO in the S112 process). In other words, the selection information provision unit 312 selects all of the UTM processing units 50-1 to 50-3 of the UTM device 5-1 if the load of all of them is greater than or equal to the load indicated by the device load score threshold, and the information communication system 1 proceeds to the S116 process. Furthermore, if one or more of the UTM processing units 50-1 to 50-3 of the UTM device 5-1 are operating at a load lower than the load indicated by the device load score threshold, the selection information provision unit 312 selects the UTM processing unit 50 operating at such a load, and the information communication system 1 proceeds to the process in S130.

[0061] In S116, the selection information provision unit 312 generates UTM selection information from the selection information acquired in the S112 process and proceeds to the S140 process. In the S116 process, for example, the numerical value of the order information of the UTM selection information corresponding to the UTM processing unit 50 (UTM processing unit 50-1 in Figure 2H) corresponding to the UTM selection count information with the smallest numerical value in the selection information is set to the smallest value (0) so that the UTM processing unit 50 corresponding to the UTM selection count information with the largest numerical value in the order information (UTM processing unit 50-3 in Figure 2H) performs UTM processing with the lowest priority so that the UTM processing unit 50 corresponding to the UTM selection count information with the largest numerical value in the order information is set to the largest value (2) so that the UTM processing unit 50 corresponding to the UTM selection information corresponding to the UTM processing unit 50 (UTM processing unit 50-3 in Figure 2H) performs UTM processing with the lowest priority. For example, the numerical value of the UTM selection count information of the UTM selection information corresponding to the UTM processing unit 50 becomes an intermediate value (1) so that the UTM processing unit 50 performs UTM processing with a priority between the highest priority and the lowest priority.

[0062] In other words, the selection information provision unit 312 assigns sequential information to the UTM processing units 50 when the actual device load of all UTM processing units 50 is lighter than the device load corresponding to the device load score threshold. The numerical value of the sequential information is set to a smaller value the fewer the numerical value of the UTM selection count information corresponding to the UTM processing unit 50, thereby increasing the priority of UTM processing by the UTM processing unit 50. On the other hand, the numerical value of the sequential information is set to a larger value the more the numerical value of the UTM selection count information corresponding to the UTM processing unit 50 is, thereby decreasing the priority of UTM processing by the UTM processing unit 50.

[0063] In other words, in S116, the smaller the numerical value of the UTM selection count information included in the selection information corresponding to a certain UTM processing unit 50 is compared to the numerical value of the UTM selection count information included in the selection information corresponding to other UTM processing units 50, the smaller the numerical value of the sequence information included in the UTM selection information corresponding to that UTM processing unit 50 becomes, so that the UTM processing unit 50 is processed first with a higher priority. Conversely, the larger the numerical value of the UTM selection count information included in the selection information corresponding to a certain UTM processing unit 50 is compared to the numerical value of the UTM selection count information included in the selection information corresponding to other UTM processing units 50, the larger the numerical value of the sequence information included in the UTM selection information corresponding to that UTM processing unit 50 becomes, so that the UTM processing unit 50 is processed later with a lower priority.

[0064] Let's explain why sequential information is assigned to the UTM processing units 50 in this way. First, let's assume that the number of times a UTM has been selected is not included in the selection information. In this case, depending on the settings for the management device 3, for example, the UTM processing unit 50 corresponding to the device information ij (e.g., device information 1-1) that is included in the UTM selection information first may be selected with the highest priority to perform UTM processing first. On the other hand, the UTM processing unit 50 corresponding to the device information ij (e.g., device information nm) that is included in the UTM selection information last may be selected with the lowest priority to perform UTM processing later.

[0065] Thus, if the selection information does not include information on the number of times a UTM has been selected, the priority of UTM processing for UTM processors 50-1 to 50-3 included in UTM device 5-1 would be fixed, and for example, in UTM device 5-1, UTM processor 50-1 would always perform UTM processing. In this case, UTM processors 50-1 to 50-3 would not be able to distribute the UTM processing within UTM device 5-1. On the other hand, if the selection information includes information on the number of times a UTM has been selected, and priorities are assigned based on this information, the fixing of the priority of UTM processing for UTM processors 50-1 to 50-3 can be avoided, and in UTM device 5-1, two or more of the UTM processors 50-1 to 50-3 can distribute the UTM processing, thus achieving the distribution of UTM processing.

[0066] The process shown in Figure 4 (S10) includes two decision processes S114 and S130, of which S114 is performed first and S130 is performed second. Therefore, the process of setting numerical order information indicating the priority of UTM processing for each UTM processing device 50 is performed first for UTM processing devices 50 operating at a load greater than or equal to the load score threshold (S116), second for UTM processing devices 50 operating at a load greater than or equal to the load score threshold and having a line speed greater than or equal to the line speed score threshold (S132), and finally for UTM processing devices 50 operating at a load greater than or equal to the load score threshold and having a line speed lower than the line speed score threshold (S134). In other words, the process of setting numerical order information is performed according to the priority according to the combination of processing load and communication speed of the UTM processing device 50.

[0067] In S130, the selection information provision unit 312 compares the numerical value of the line speed score corresponding to the UTM processing device 50 included in the selection information acquired in the S112 process with the line speed score threshold (second threshold) included in the threshold information (Figure 2J). The information communication system 1 proceeds to the S132 process if the numerical value of the line speed score is not smaller than the line speed score threshold (NO in the S130 process), and to the S134 process if it is smaller (YES in the S130 process). In other words, in the S114 process, the selection information provision unit 312 selects a UTM processing device 50 that has a line speed higher than the line speed indicated by the line speed score threshold from among the UTM processing devices 50 that are determined to operate at a load higher than the load indicated by the device load score threshold, and the information communication system 1 proceeds to the S132 process. Furthermore, the selection information provision unit 312, in the process of S114, selects a UTM processing device 50 that has a higher line speed than the line speed indicated by the line speed score threshold, among the UTM processing devices 50 with a higher load than indicated by the device load score threshold, and the information communication system 1 proceeds to the process of S134.

[0068] In S132, the selection information providing unit 312 generates UTM selection information from the selection information acquired in the processing of S112 and proceeds to the processing of S140. In other words, the selection information providing unit 312 generates UTM selection information by assigning priority order information according to the numerical value of the UTM selection count information to UTM processing devices 50 that operate at a load higher than the load indicated by the device load score threshold and have a line speed higher than the line speed indicated by the line speed score threshold. In the processing of S132, similar to the processing of S116, for example, the numerical value of the order information of the UTM selection information corresponding to the UTM processing device 50 corresponding to the UTM selection count information with the smallest numerical value of the UTM selection count information included in the selection information is set to the smallest value so that the UTM processing device 50 corresponding to the UTM selection count information with the smallest numerical value of the UTM selection count information included in the selection information performs UTM processing first with the highest priority. On the other hand, for example, the value of the UTM selection information of the UTM selection information corresponding to the UTM processing device 50 corresponding to the UTM selection information with the largest numerical value of the UTM selection count information included in the selection information is set to the largest value so that the UTM processing device 50 corresponding to the UTM selection information with the largest numerical value of the UTM selection count information included in the selection information performs UTM processing later with the lowest priority.

[0069] In other words, the selection information providing unit 312 reduces the numerical value of the order information included in the UTM selection information corresponding to the UTM processing device 50, so that the smaller the numerical value of the UTM selection count information included in the selection information corresponding to the UTM processing device 50 selected as described above, the higher the priority given to the UTM processing device 50 corresponding to the selection information including the UTM selection count information, and the earlier the UTM processing device 50 is processed.

[0070] Conversely, among the UTM processing units 50 selected as described above, the larger the numerical value of the UTM selection count information included in the selection information corresponding to this UTM processing unit 50, the smaller the numerical value of the order information included in the UTM selection information corresponding to this UTM processing unit 50 will be, so that the UTM processing unit 50 corresponding to the selection information containing this UTM selection count information will perform UTM processing later with a lower priority.

[0071] In other words, the selection information providing unit 312 prioritizes UTM processing devices 50 whose actual device load is heavier than the device load indicated by the device load score threshold, and whose line speed is faster than or equal to the j-line speed indicated by the line score threshold, by assigning a smaller value to the order information of the UTM selection information corresponding to that UTM processing device 50. On the other hand, the selection information providing unit 312 prioritizes a UTM processing device 50 by assigning a larger value to the order information of the UTM selection information corresponding to that UTM processing device 50, as the numerical value of the UTM selection count information corresponding to that UTM processing device 50 increases.

[0072] In S134, the selection information providing unit 312 generates UTM selection information from the selection information acquired in the S112 process and proceeds to the S140 process. In the S132 process, similar to the S116 process, for example, the value of the UTM count in the UTM selection information corresponding to the UTM selection information with the smallest numerical value of UTM selection count information included in the selection information is made as small as possible so that the UTM processing device 50 corresponding to the UTM selection information with the smallest numerical value of UTM selection count information included in the selection information performs UTM processing with the highest priority. On the other hand, for example, the value of the UTM selection information in the UTM selection information corresponding to the UTM selection information with the largest numerical value of UTM selection count included in the selection information performs UTM processing with the lowest priority so that the UTM processing device 50 corresponding to the UTM selection information with the largest numerical value of UTM selection count information included in the selection information is made as large as possible.

[0073] In other words, in S134, the selection information providing unit 312 first selects a UTM processing device 50 that corresponds to selection information including a device load score smaller than the device load score threshold and a line speed score smaller than the line speed score threshold. Furthermore, similar to S116, the selection information providing unit 312 reduces the numerical value of the sequence information included in the UTM selection information corresponding to the selected UTM processing device 50 so that the smaller the numerical value of the UTM selection count information included in the selection information, the higher the priority the UTM processing device 50 corresponding to the selection information including this UTM selection count information will perform UTM processing. Conversely, similar to S116, the selection information providing unit 312 increases the numerical value of the sequence information included in the UTM selection information corresponding to the selected UTM processing device 50 so that the larger the numerical value of the UTM selection count information included in the selection information, the lower the priority the UTM processing device 50 corresponding to the selection information including this UTM selection count information will perform UTM processing.

[0074] In other words, when the actual device load of each UTM processing unit 50 is heavier than the device load corresponding to the device load score threshold, and the actual line speed is lower than the line speed corresponding to the line score threshold, the selection information unit 312 assigns a smaller value to the UTM selection information corresponding to the UTM processing unit 50, thereby increasing its priority, as the numerical value of the UTM selection count information corresponding to the UTM processing unit 50 that meets these conditions is smaller. On the other hand, the selection information unit 312 assigns a larger value to the UTM selection information corresponding to the UTM processing unit 50, thereby decreasing its priority, as the numerical value of the UTM selection count information corresponding to the UTM processing unit 50 is larger.

[0075] In S140, the selection information provision unit 312 transmits the generated UTM selection information to all UTM processing units 50-1 to 50-3 included in the UTM device 5-1 via the communication processing unit 300 and the wide area network 100. Each network communication processing unit 500 of the UTM processing units 50-1 to 50-3 receives the UTM selection information from the management device 3 via the wide area network 100.

[0076] In S142, the UTM selection information acquisition unit 506 acquires UTM selection information from the data received by the network communication processing unit 500. Based on the acquired UTM selection information, the selection unit 508 determines whether the UTM processing unit 50, which includes this selection unit 508, will perform UTM processing, or whether another UTM processing unit 50, other than the UTM processing unit 50, will perform UTM processing. Furthermore, based on this determination result, the selection unit 508 controls whether or not to have the UTM processing unit 502, which is included in the same UTM processing unit 50 as this selection unit 508, perform UTM processing, and then terminates the process.

[0077] Next, the overall operation of the information communication system 1 will be explained with reference to Figures 5A to 5C. Figures 5A to 5C are communication sequence diagrams illustrating an example of operation (S20, S24, S25) of the information communication system 1 when the UTM processing units 50-1 to 50-3 included in the UTM device 5-1 perform UTM processing in the priority order illustrated in Figure 2K. In the communication sequence shown in Figure 5A, as illustrated in Figure 2H, among the UTM processing units 50-1 to 50-3 included in the UTM device 5-1, the UTM processing unit 50-1 performs UTM processing with the highest priority, the UTM processing unit 502 performs UTM processing with the next highest priority, and the UTM processing unit 50-3 performs UTM processing with the lowest priority. Also, in Figures 5A to 5C, the subscripts of the component symbols are omitted as appropriate.

[0078] Furthermore, in the communication sequence shown in Figures 5A to 5C, a specific example is when node 58, connected to UTM processing unit 50-3 via a short-range communication line 56, starts transmitting data to the wide-area network 100, and UTM processing unit 50-1 performs UTM processing on the data transmitted between node 58 and the wide-area network 100 instead of UTM processing unit 50-3. Figure 5A shows the normal operation of the information communication system 1 when no threat is detected in the data transmitted between node 58 and the wide-area network 100. Figure 5B shows the abnormal operation of the information communication system 1 when a threat is detected in the data from node 58 to the wide-area network 100, for example, when the web page accessed by node 58 via the wide-area network 100 is inaccessible. Figure 5C shows the abnormal operation of the information communication system 1 when a threat such as a computer virus is detected in the data from the wide-area network 100 to node 58.

[0079] As shown in Figure 5A, in S200, for example, node 58-3-1 sends a connection request to the wide-area network 100 to the UTM processing unit 50-3 of UTM device 5-1, which is connected via the short-range communication line 56-3. In S202, the UTM processing unit 50-3 generates control request information (Figure 2I). In S204, the UTM processing unit 50-3 transmits the generated control request information to the management device 3 via the wide-area network 100.

[0080] In S206, the management device 3 generates UTM selection information (Figure 2K). In S208, the management device 3 transmits this information to all UTM processing units 50-1 to 50-3 of the UTM device 5-1 via the wide area network 100. In S210, the UTM device 5-3 sends an ACK (Acknowledge) signal to node 58-3-1 indicating that the connection request has been acknowledged. In S212, node 58-3-1 transmits the data to be transmitted to the wide area network 100 to the UTM processing unit 50-3. In S214, the UTM processing unit 50-3 receives the data from node 58-3-1 and forwards it to the UTM processing unit 50-1 via the short-range communication line 52-3.

[0081] In S216, the UTM processing unit 50-3 performs UTM processing on the data transferred from the UTM processing unit 50-1 and determines whether the data contains threats that could be detrimental to the terminal system 54 and its users, such as access information to restricted websites. As a result of this determination, the UTM processing unit 50-3 determines that the data transferred from the UTM processing unit 50-1 does not contain any threats (no threat). In S218, the UTM processing unit 50-1 transmits the data transferred from the UTM processing unit 50-3 to the wide area network 100.

[0082] In S230, the UTM processing unit 50-1 receives data transmitted from the wide area network 100 to node 58-3-1. In S232, the UTM processing unit 50-1 performs UTM processing on the received data and determines whether the data contains threats that could cause harm to the terminal system 54 and its users, such as computer viruses. As a result of this determination, the UTM processing unit 50-3 determines that the data transferred from the UTM processing unit 50-1 does not contain any threats.

[0083] In S234, the UTM processing unit 50-1 transfers the data received from the wide-area network 100 to the UTM processing unit 50-3 via the short-range communication line 52-3. In S236, the UTM processing unit 50-1 transmits the data transferred from the UTM processing unit 50-3 to node 58-3-1 via the short-range communication line 56-3.

[0084] Furthermore, as shown in Figure 5B, the information communication system 1 performs the communications S200 to S214 shown in Figure 5A. In S240, the UTM processing unit 50-1 performs UTM processing on the data transferred from the UTM processing unit 50-3 and determines whether the data contains threats that could cause harm or disadvantage to the terminal system 54 and its users, such as access information to restricted websites. As a result of this determination, the UTM processing unit 50-3 determines that the data transferred from the UTM processing unit 50-1 contains threats (threat present).

[0085] In S242, the UTM processing unit 50-1 sends a threat detection message to the UTM processing unit 50-3 via the short-range communication line 52-3, for example, indicating to node 58-3-1 that a threat has been detected from the data received from node 58-3-1. In S242, the UTM processing unit 50-3 sends the threat detection message received from the UTM processing unit 50-1 to node 58-3-1 via the short-range communication line 56-3.

[0086] Furthermore, as shown in Figure 5C, the information communication system 1 performs the communications S200 to S218 shown in Figure 5A. In S250, the UTM processing unit 50-1 receives data transmitted from the wide area network 100 to node 58-3-1. In S252, the UTM processing unit 50-1 performs UTM processing on the received data and determines whether the data contains threats that could cause harm to the terminal system 54 and its users, such as computer viruses. As a result of this determination, the UTM processing unit 50-3 determines that the data transferred from the UTM processing unit 50-1 contains threats.

[0087] In S254, the UTM processing unit 50-1 transmits a threat detection message to the UTM processing unit 50-3 via the short-range communication line 52-3, indicating to node 58-3-1, for example, that a threat has been detected in data transmitted from the wide-area network 100 to node 58-3-1. In S242, the UTM processing unit 50-3 transmits the threat detection message received from the UTM processing unit 50-1 to node 58-3-1 via the short-range communication line 56-3.

[0088] Next, we will describe the hardware configuration of the computer 8 used when one or more components of the information and communication system 1 are implemented in software by one or more programs or one or more program modules. Such one or more programs or one or more program modules are executed by specifically utilizing the hardware resources of the computer 8. Figure 6 is a diagram illustrating an example of the hardware configuration of the computer 8 that executes one or more programs or one or more program modules that implement one or more components of the information and communication system 1 in software.

[0089] As shown in Figure 6, the computer 8 comprises one or more processors 800, a main memory 802, an auxiliary memory 804, and a network interface device 806, all connected to each other via buses and signal lines to enable data communication. However, the hardware configuration example shown in Figure 6 is just one example of a hardware configuration that realizes each function of the information communication system 1, and does not limit the hardware configuration of the computer 8. Furthermore, the computer 8 may include components not shown in Figure 6.

[0090] The main memory 802 includes one or more volatile memory elements such as RAM (Random Access Memory) and one or more non-volatile memory elements such as ROM (Read Only Memory) and flash memory. The main memory 802 stores, for the medium or long term, one or more programs or one or more program modules or combinations thereof that realize one or more components of the information communication system 1. The main memory 802 also temporarily stores data necessary for the execution of one or more programs or one or more program modules.

[0091] The processor 800 includes one or more CPUs, one or more DSPs, one or more FPGAs (Field Programmable Gate Arrays), or two or more combinations thereof. When there are multiple processors 800, each of the multiple processors 800 includes one or more CPUs, one or more DSPs, one or more FPGAs, or two or more combinations thereof. The processor 800 executes the OS that runs on the computer 8. The processor 800 also uses the OS to execute instructions contained in one or more programs or one or more program modules stored in the main memory 802.

[0092] The auxiliary storage device 804 includes, for example, a non-volatile storage device such as an HDD (Hard Disk Drive), SSD (Solid State Drive), or optical storage device, and a USB (Universal Serial Bus) port to which a non-transitory computer-readable storage medium can be connected. The auxiliary storage device 804 stores, for example, one or more programs or one or more program modules executed by the processor 800 for a long period of time, such as when the computer 8 is powered off and not running.

[0093] One or more programs or program modules may be provided to computer 8 as program products stored on a non-volatile storage medium. The one or more programs or program modules stored on the non-volatile storage medium are installed in auxiliary storage device 804, loaded into main memory 802, and executed by processor 800. Furthermore, the installed one or more programs or program modules may be updated by update programs provided to computer 8 via the wide-area network 100 or via the non-volatile storage medium.

[0094] The network interface device 806 provides an interface for sending and receiving data between the processor 800, main memory 802, and auxiliary storage 804, which are connected via a bus or the like, and the wide area network 100.

[0095] The UTM processing units 50-1 to 50-m included in the management device 3 and UTM devices 5-1 to 5-n described above constitute a cloud system capable of distributed UTM processing. Therefore, the UTM processing load can be distributed across all UTM processing units 50-1 to 50-m without any single UTM processing unit 50-1 to 50-m becoming overloaded. Furthermore, in UTM devices 5-1 to 5-n, the transmission and reception volumes of each UTM processing unit 50-1 to 50-m are generally not uniform, resulting in biases. By having a UTM processing unit 50 with low transmission and reception volumes take over the UTM processing of other UTM processing units 50 with high transmission and reception volumes, the processing load can be made more uniform among the UTM processing units 50-1 to 50-m.

[0096] Furthermore, in recent years, attack methods against servers used by organizations such as companies have been evolving daily, making it difficult to prevent attacks using only firewalls installed on each node 58-1-1 to 58-mn. In contrast, by using the UTM processing units 50-1 to 50-m included in each UTM device 5-1 to 5-n, nodes 58-1-1 to 58-mn can be reliably protected from attacks, even in organizations with a large number of users and sessions. Moreover, the degradation of processing performance caused by excessive load on UTM processing in the UTM processing units 50-1 to 50-m included in each UTM device 5-1 to 5-n can be more effectively prevented by load balancing based on machine learning in relation to line speed and device load.

[0097] Some or all of the above embodiments may also be described as follows, but are not limited to the following: [Note 1] (See the first perspective above) [Note 2] The management device according to Appendix 1, wherein the line speed includes at least a first data rate of data transmitted from each of the plurality of integrated threat management processing devices in the outward direction and a second data rate of data transmitted from the outward direction to each of the plurality of integrated threat management processing devices. [Note 3] The device load includes at least the utilization rate of one or more CPUs (Central Processing Units) included in each of the plurality of integrated threat management processing devices, and a utilization rate that represents the ratio of the processing load of the integrated threat processing to the processing capacity of each of the plurality of integrated threat management processing devices. The control device described in Appendix 1 or 2. [Note 4] The aforementioned line speed score is generated based on the results of machine learning on the line speed by the management device described in any of the appendices 1 to 3. [Note 5] The device load score is generated based on the results of machine learning on the device load, according to the management device described in Appendix 3 or 4. [Note 6] A management device according to any one of the appendices 1 to 5, which performs a process to set a priority for all integrated threat management processing devices when the device load of all the integrated threat management processing devices is greater than the device load corresponding to a first threshold, and performs the process to set the priority for an integrated threat management processing device among all the integrated threat management processing devices whose device load is less than or equal to the device load corresponding to the first threshold and whose line speed is lower than the line speed corresponding to a second threshold, or performs the process to set the priority for an integrated threat management processing device among all the integrated threat management processing devices whose device load is less than or equal to the device load corresponding to the first threshold and whose line speed is equal to or greater than the line speed corresponding to a second threshold. [Note 7] In the process of setting the priority, among all the integrated threat management processing devices, the integrated threat management processing device whose device load is less than or equal to the device load corresponding to the first threshold and whose line speed is lower than the line speed corresponding to the second threshold, or the integrated threat management processing device whose device load is less than or equal to the device load corresponding to the first threshold and whose line speed is equal to or greater than the line speed corresponding to the second threshold, the less the number of times the integrated threat management processing device has performed the integrated threat management processing, the higher the priority assigned to the integrated threat management processing device as described in any of the appendices 1 to 6. [Note 8] (See the second perspective above) [Note 9] (See the third perspective above) [Note 10] (See the fourth perspective above) It goes without saying that any combination of the forms described in the appendices of this disclosure, or any combination of the elements described in each perspective and embodiment (including the non-selection of some elements), can be made from time to time by those skilled in the art, in accordance with the basic concepts of this disclosure.

[0098] Furthermore, each disclosure of the above-mentioned patent documents and other materials cited is incorporated into this publication by reference. Within the framework of this disclosure (including the claims), further modifications and adjustments to the embodiments or examples are possible based on their fundamental technical concept. Also, within the framework of this disclosure, various combinations or selections (including partial deletions) of various disclosed elements (including each element of each claim, each element of each embodiment or example, each element of each drawing, etc.) are possible. In other words, this disclosure naturally includes various modifications and changes that a person skilled in the art could make in accordance with the entire disclosure, including the claims, and the technical concept. In particular, the numerical ranges described in this publication should be interpreted as specifically describing any numerical value or sub-range included within that range, even if not specifically noted. Furthermore, each disclosure of the above-mentioned cited documents is deemed to be included in the disclosures of this application, which may be used in part or in whole as part of this disclosure, in accordance with the spirit of this disclosure, as necessary. [Explanation of symbols]

[0099] 1. Information and communication systems 100 Wide Area Network (WAN) 3 Management device 300 Communication Processing Unit 302 Communications Information Gathering Department 304 Information Database for Machine Learning 306 Device Information Database 308 Machine Learning Department 310 Selection Information Database 312 Information Provision Department for Selection 5 UTM device 50 UTM Processing Units 500 Network Communication Processing Unit 502 UTM Processing Unit 504 Terminal Communication Processing Unit 506 UTM Selection Information Acquisition Unit 508 Selection Section 510 UTM part IF 512 Control Request Unit 52,56 Short-range communication lines 54 Terminal Systems 58 nodes 8 Computers 800 processors 802 Main storage 804 Auxiliary storage 806 Network Interface Device

Claims

1. A management device that includes one or more processors and manages the priority of one or more nodes connected to one or more integrated threat management devices, each including a plurality of integrated threat management processing devices, to determine which of the plurality of integrated threat management processing devices will preferentially perform integrated threat processing to protect against external threats, The one or more processors mentioned above are: The line speed of each of the multiple integrated threat management processing devices included in any of the integrated threat management devices is quantified to generate a line speed score. The device load of each of the aforementioned multiple integrated threat management processing devices is quantified to generate a device load score. Each of the aforementioned multiple integrated threat management processing devices counts the number of times it has performed the integrated threat processing. Based on the generated line speed score, device load score, and the number of times integrated threat processing has been performed, an order indicating the priority of each of the multiple integrated threat management processing devices is generated. A control device configured to perform processing.

2. The aforementioned line speed includes at least a first data rate of data transmitted from each of the plurality of integrated threat management processing units in the direction of the outside, and a second data rate of data transmitted from the direction of the outside to each of the plurality of integrated threat management processing units. The control device according to claim 1.

3. The device load includes at least the utilization rate of one or more CPUs (Central Processing Units) included in each of the plurality of integrated threat management processing devices, and a utilization rate that represents the ratio of the processing load of the integrated threat processing to the processing capacity of each of the plurality of integrated threat management processing devices. The control device according to claim 1.

4. The aforementioned line speed score is generated based on the results of machine learning on the line speed. The control device according to claim 1.

5. The device load score is generated based on the results of machine learning on the device load. The control device according to claim 3.

6. When the device load of all the integrated threat management processing devices is greater than the device load corresponding to the first threshold, a process is performed to set a priority for all the integrated threat management processing devices. The process of setting the priority is performed for an integrated threat management processing device among all of the integrated threat management processing devices whose device load is less than or equal to the device load corresponding to the first threshold, and whose line speed is lower than the line speed corresponding to the second threshold, or The process of setting the priority is performed for the integrated threat management processing device among all of the integrated threat management processing devices whose device load is less than or equal to the device load corresponding to the first threshold, and whose line speed is equal to or greater than the line speed corresponding to the second threshold. The control device according to claim 1.

7. In the process of setting the priority, All of the aforementioned integrated threat management processing devices, The integrated threat management processing device, wherein the device load is less than or equal to the device load corresponding to the first threshold, and the line speed is lower than the line speed corresponding to the second threshold, Among the integrated threat management processing devices, the device load is less than or equal to the device load corresponding to the first threshold, and the line speed is equal to or greater than the line speed corresponding to the second threshold, The fewer times the integrated threat management processing device has performed the integrated threat management process, the higher the priority assigned to that integrated threat management process. The control device according to claim 6.

8. One or more integrated threat management devices, Multiple integrated threat management processing devices included in the one or more integrated threat management devices, One or more nodes connected to multiple integrated threat management processing devices included in the one or more integrated threat management devices, A management device that includes one or more processors and manages the priority of which of the plurality of integrated threat management processing devices will preferentially perform integrated threat processing to protect the one or more nodes from external threats. Equipped with, One or more processors of the aforementioned management device are: The line speed of each of the multiple integrated threat management processing devices included in any of the integrated threat management devices is quantified to generate a line speed score. The device load of each of the aforementioned multiple integrated threat management processing devices is quantified to generate a device load score. Each of the aforementioned multiple integrated threat management processing devices counts the number of times it has performed the integrated threat processing. Based on the generated line speed score, the device load score, and the number of times integrated threat processing has been performed, an order indicating the priority of each of the multiple integrated threat management processing devices is generated and transmitted to each of the multiple integrated threat management processing devices. Configured to perform the processing Management system.

9. A management method for managing the priority of which of the multiple integrated threat management devices will perform integrated threat processing to protect one or more nodes connected to one or more integrated threat management devices, which include multiple integrated threat management devices, from external threats, A step of generating a line speed score by quantifying the line speed of each of the multiple integrated threat management processing devices included in any of the integrated threat management devices, The steps include: quantifying the device load of each of the multiple integrated threat management processing devices and generating a device load score; The steps include counting the number of times each of the plurality of integrated threat management processing devices has performed the integrated threat processing, A step of generating an order indicating the priority of each of the multiple integrated threat management processing devices based on the generated line speed score, the device load score, and the number of times the integrated threat processing has been performed. Management methods including those mentioned.

10. A program executed in a management device that manages the priority of which of the multiple integrated threat management devices will perform integrated threat processing to protect one or more nodes connected to one or more integrated threat management devices, which include one or more processors and multiple integrated threat management processing devices, from external threats, In the above one or more processors, A process for quantifying the line speed of each of the multiple integrated threat management processing devices included in any of the integrated threat management devices and generating a line speed score, A process for quantifying the device load of each of the aforementioned multiple integrated threat management processing devices and generating a device load score, A process for counting the number of times each of the multiple integrated threat management processing devices has performed the integrated threat processing, A process for generating an order indicating the priority of each of the multiple integrated threat management processing devices based on the generated line speed score, the device load score, and the number of times the integrated threat processing has been performed. A program that executes the command.

Images