Security center and control method for security center

Abstract

To provide a security center capable of constantly reducing the risk of hacking and virus infection by making a connection to a public Internet network only for a limited time, and a method for controlling the security center.SOLUTION: A client computer sends connection destination information of a desired Internet service on a public Internet network to cause the sandbox computer to make a connection and acquire a domain and an IP address of the Internet service due to prescribed operation, the sandbox computer sends the acquired domain or the like of the Internet to the client computer, and the client computer makes a connection the Internet service to use it by using the domain or the like of the Internet service acquired by making a connection to the public Internet network only for a period of using the Internet service, and cannot make a connection to the public Internet service again after ending the use.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present invention relates to a security center and a control method for the security center that receives security information on the security situation via a telecommunication line from a security terminal that monitors the security situation at a secured facility, and monitors the secured facility based on report information, which is information necessary for security including the security information. [Background technology]

[0002] Conventionally, a security center receives security information on the security situation via a telecommunication line from a security terminal that monitors the security situation of a security target facility. For example, if a suspicious person such as a thief breaks into a security target facility, the security center receives the security information on the break-in and dispatches security guards to the security target facility as necessary. When dispatching security guards, it is common to use map information provided as an Internet service via the public Internet network to obtain a map of the security target facility to which the guards should be dispatched.

[0003] However, the security company that operates the security center receives security information from security sensors and security cameras installed in the facilities to be protected, such as offices and homes, via a security terminal and monitors security. The security company determines the level of urgency from this security information and dispatches security guards to the office, etc. At this time, if the security company can obtain the location information of the security guard who will be dispatched to the scene and the security camera footage of the scene, it can give more accurate instructions and handle the situation. This location information and security camera footage are often provided by Internet services provided via the public Internet network.

[0004] However, connecting security centers directly to the public Internet network poses the risk of infection by computer viruses. In addition, security centers are required to operate 24 hours a day, 365 days a year, so it is difficult to update the OS and software, and the introduction of antivirus software can lead to unstable operation. To avoid these issues, security centers connect to the public Internet network, but in many cases they do not allow connections to Internet services that anyone can access.

[0005] Various methods have been proposed to solve the security problems of connecting to Internet services via such a public Internet network. For example, Patent Document 1 proposes that an information processing device of a user outside an organization can be easily connected to a network within the organization while maintaining security. Specifically, in the communication system of Patent Document 1, a connection control unit controls opening and closing of a connection between a first communication unit that communicates with a terminal device and a second communication unit that communicates via the network, and a connection setting unit instructs the connection control unit to open and close the connection according to a user input received by an input unit in response to first identification information output from a terminal device displayed on a display unit.

[0006] The security system of Patent Document 2 prevents the intrusion of unauthorized data at the entrance of an internal network and improves the security of a computer system by isolating an infected computer with unauthorized data. The security system of Patent Document 2 includes an entrance protection system that prevents the intrusion of unauthorized data at the front end of the computer network and an exit protection system that suppresses unauthorized operations by infected computers, and the exit protection system further includes an exclusion system that isolates infected computers from the computer network. [Prior art documents] [Patent documents]

[0007] [Patent Document 1] JP 2015-84515 A [Patent Document 2] JP 2020-47175 A Summary of the Invention [Problem to be solved by the invention]

[0008] Although various security measures have been proposed, it is difficult to implement them.

[0009] The present invention has been made in consideration of the above circumstances, and aims to provide a security center and a method for controlling a security center that can reduce the risk of constant hacking and virus infection by connecting to a public Internet network for only a limited period of time. [Means for solving the problem]

[0010] The security center described in claim 1 includes a center device that receives security information of a facility to be guarded, a client computer that manages the security information received by the center device and is configured not to be connected to a public Internet network at all times, and a sandbox computer that is connectable to the public Internet network, and the client computer transmits to the sandbox computer information on the public Internet network due to a predetermined operation of the center device. The specific one you want to connect to Send the Internet service connection information to connect to the sandbox computer The specific one you want to connect to Internet service domains and IP addresses Relationship with The sandbox computer will then The specific one you want to connect to Internet service domains and IP addresses Relationship with to the client computer, and the client computer The specific one you want to connect to The sandbox computer was connected to the public Internet network only during the period when the Internet service was used. The specific one you want to connect to Internet service domains and IP addresses Relationship with Using The specific one you want to connect toThe client computer connects to and uses the Internet service of The specific one you want to connect to A distinctive feature of this service is that once you have finished using it, you will no longer be able to connect to the public Internet network.

[0011] The security center according to claim 2, wherein the client computer acquires the information from the sandbox computer. The specific one you want to connect to Internet service domains and IP addresses Relationship with The domain and IP address recorded in the specified file are I want to connect with a specific You can only connect to the Internet service The specific one you want to connect to When the connection to the Internet service is terminated, the information in the specified file is The specific Internet service domains and IP addresses Relationship with The present invention is characterized in that it deletes the following:

[0012] The security center according to claim 3 is characterized in that the predetermined file is a HOSTS file.

[0013] The security center according to claim 4 is characterized in that the sandbox computer stops operating or is turned off during a period when no communication with the client computer is being performed.

[0014] The security center described in claim 5 is characterized in that it has a switch means capable of setting restrictions on the exchange of information between the client computer and the sandbox computer, and that information exchange is possible only when it is necessary.

[0015] The security center according to claim 6 is characterized in that the client computer is normally set to a network setting that does not use a default gateway and a DNS server so that the client computer cannot connect to a public Internet network, and when the client computer is connected to a public Internet network, The specific one you want to connect toWhen connecting to the Internet service, the IP address of the router means connected between the client computer and the public Internet network is temporarily set in the setting of the default gateway to enable connection to the public Internet network; The specific one you want to connect to After the user has finished using the Internet service, the default gateway settings are restored to their original state to prevent the user from connecting to the public Internet network.

[0016] The control method of the security center according to claim 7 comprises, in response to a predetermined operation of a center device that receives security information of a security target facility, managing the security information received by the center device and a client computer that is configured not to be connected to a public Internet network at all times, transmitting a public Internet network-related information to a sandbox computer that is connectable to the public Internet network. The specific one you want to connect to Send the Internet service connection information to connect to the sandbox computer The specific Internet service domains and IP addresses Relationship with The sandbox computer will then The specific one you want to connect to Internet service domains and IP addresses Relationship with to the client computer, and the client computer The specific one you want to connect to The sandbox computer was connected to the public Internet network only during the period when the Internet service was used. The specific one you want to connect to Internet service domains and IP addresses Relationship with Using The specific one you want to connect to The client computer connects to and uses the Internet service of The specific one you want to connect to A distinctive feature of this service is that once you have finished using it, you will no longer be able to connect to the public Internet network.

[0017] The control method of the security center according to claim 8, further comprising: The specific Internet service domains and IP addresses Relationship withThe domain and IP address recorded in the specified file are I want to connect with a specific You can only connect to the Internet service The specific When the connection to the Internet service is terminated, the information in the specified file is The specific Internet service domains and IP addresses Relationship with The present invention is characterized in that it deletes the following:

[0018] The control method for a security center according to claim 9 is characterized in that the predetermined file is a HOSTS file.

[0019] The control method for the security center according to claim 10 is characterized in that the sandbox computer stops operating or is turned off during a period when the sandbox computer does not communicate with the client computer.

[0020] The control method of the security center according to claim 11 is characterized in that the client computer and the sandbox computer can exchange information with each other only when such exchange is necessary.

[0021] The control method of the security center according to claim 12 further comprises the steps of: a client computer is normally configured to not use a default gateway and a DNS server so as not to be connected to a public Internet network; and a client computer is normally configured to not use a default gateway and a DNS server so as not to be connected to a public Internet network. The specific one you want to connect to When connecting to the Internet service, the IP address of the router means connected between the client computer and the public Internet network is temporarily set in the setting of the default gateway to enable connection to the public Internet network; The specific one you want to connect to After the user has finished using the Internet service, the default gateway settings are restored to their original state to prevent the user from connecting to the public Internet network. Effect of the Invention

[0022] According to the present invention, the connection to the public Internet network is only for a limited time, thereby reducing the risk of constant hacking and virus infection. [Brief description of the drawings]

[0023] [Figure 1] 1 is a configuration diagram showing an example of a security system according to the present invention. [Diagram 2] FIG. 2 is an explanatory diagram showing an example of the configuration of a security center according to the present invention. [Diagram 3] FIG. 2 is an explanatory diagram showing the operation of the security center. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0024] Hereinafter, the embodiments of the present invention will be described in detail with reference to the drawings. Fig. 1 is a configuration diagram showing an example of a security system according to the present invention. Fig. 2 is an explanatory diagram showing an example of the configuration of a security center according to the present invention. Fig. 3 is an explanatory diagram showing the operation of the security center.

[0025] The security system 1 shown in Figure 1 is a system that receives security information regarding the security situation via a public internet network 4 from a security terminal 10 that monitors the security situation using security sensors and the like installed in multiple guarded facilities 8, and receives report information, which is information necessary for security including the security information, at a security center 20, and responds by dispatching a security guard to the guarded facility 8 where an intrusion has occurred as necessary.

[0026] The public Internet network 4 is a telecommunications line that can be shared and connected by an unspecified number of users. However, although the public Internet network 4 is a line for public use, it is possible to restrict public connections for specific routes and use the network as a dedicated line between specific users. For example, in the connection between the guarded facility 8 and the security center 20, the public Internet network 4 is often used as a dedicated line to ensure security.

[0027] 2, the security center 20 is composed of a center device 30, a client computer 40, a sandbox computer 60, routers 22, 24, 26, etc. The center device 30, the client computer 40, and the sandbox computer 60 perform the functions described in the present application by operating in cooperation with hardware and software realized by basic electronic computers, but as long as the functions described in the present application can be realized, they may be composed of only hardware, for example, and are not limited by their form.

[0028] The routers 22, 24, 26 are devices that connect the center device 30, the client computer 40, and the sandbox computer 60 to the public Internet network 4. In Fig. 2, the routers 22, 24, 26 are provided externally to the center device 30, the client computer 40, and the sandbox computer 60, respectively, but the routers 22, 24, 26 may be provided inside the center device 30, the client computer 40, and the sandbox computer 60, respectively, and are not limited by this form.

[0029] In addition, in FIG. 2 and the following description, the center device 30, the client computer 40, and the sandbox computer 60 are each shown as separate devices, but as long as the functions and effects described in this application can be achieved, the center device 30, the client computer 40, and the sandbox computer 60 can also be configured as a single device, and there are no limitations to this form.

[0030] The center device 30 is for receiving security information from the security terminal 10 in the facility 8 to be guarded via the public Internet network 4. In reality, in addition to receiving security information, the center device 30 also has various functions such as periodically monitoring the operation of the security terminal 10 and communicating with the security terminal 10 for maintenance of the security terminal 10. The center device 30 is made up of a control unit 32 that is responsible for controlling the entire center device 30, a communication unit 34 that communicates with the outside via the router 22, a memory unit 36 ​​that stores various information, etc.

[0031] The client computer 40 is connected to the center device 30 and manages security information received by the center device 30, and is configured not to be connected to the public Internet network 4 at all times. The client computer 40 is composed of a control unit 42 which controls the entire client computer 40, a communication unit 44 which communicates with the outside via the router 24, a display unit 50 which displays various information, an operation unit 52 which inputs various information and instructions, a storage unit 46 which stores various information, etc. The staff of the security center 20 mainly operate the entire security center 20 by operating the operation unit 52 while looking at various information such as security information displayed on the display unit 50 of the client computer 40.

[0032] The sandbox computer 60 is a device that can be connected to the public Internet network 4, and is connected to the client computer 40 via, for example, a LAN switch 28. The LAN switch 28 is a switch means provided between the client computer 40 and the sandbox computer 60, and is capable of restricting the exchange of information between them. The LAN switch 28, which is a switch means, has a function of allowing information exchange only when information exchange is necessary. The LAN switch 28 in this embodiment is used when the client computer 40 and the sandbox computer 60 are connected on a LAN line, and the client computer 40 and the sandbox computer 60 can be connected or disconnected by operating the LAN switch 28. The switch means (for example, the LAN switch 28) may be configured to physically turn on / off the connection, or may be configured to enable or restrict the exchange of information by software, and is not limited by its form. The LAN switch 28 is a switch means that takes LAN connection into consideration, but the connection between the client computer 40 and the sandbox computer 60 via the switch means is not limited to LAN connection.

[0033] The sandbox computer 60 is made up of a control unit 62 which is responsible for controlling the entire sandbox computer 60, a communication unit 64 which communicates with the outside via the router 26, and the like.

[0034] Next, the operation of the security center 20 configured as described above will be described. The client computer 40 and the sandbox computer 60 in the security center 20 of the present application are allowed to connect to the public Internet network 4 for a limited period (for example, several minutes) due to a specified operation of the center device 30. The specified operation of the center device 30 is, for example, a case where a disaster such as a suspicious person invades the security target facility 8 occurs, but may be due to other factors, and is not particularly limited and is optional (the following description is given for a case where a disaster such as a suspicious person invades the security target facility 8 occurs). When a disaster such as a suspicious person invades the security target facility 8 occurs, this is a very important event in terms of security, and it is extremely important to allow the connection to the public Internet network 4 for a limited period (for example, several minutes) due to such an important event in terms of security. As another factor, a version upgrade of the OS of the client computer 40 or the like is assumed.

[0035] The client computer 40 is set by the network setting means 42b, the function of which is realized by the control unit 42, so that it cannot be connected to the public Internet network 4 at all times. One method for preventing connection to the public Internet network 4 is to cut off the connection by using a mechanical contact, but in this embodiment, a method for preventing disconnection by using software will be described. Specifically, the network settings of the client computer 40 (set by the network setting means 42b) are set so that the default gateway and DNS server are not used at all times, so that it cannot be connected to the public Internet network 4.

[0036] The sandbox computer 60 is separated from the client computer 40 in terms of sending and receiving information via a LAN switch 28. It is preferable that the sandbox computer 60 is stopped or, preferably, turned off during periods when it is not communicating with the client computer 40 (in the following explanation, the sandbox computer 60 is turned off). When the sandbox computer 60 is turned off, it is preferable that various internal storages of the sandbox computer 60 are returned to their initial states. In addition, the sandbox computer 60 is equipped with antivirus software, and the sandbox computer 60 is adapted to periodically update its OS and the like during periods when it is not communicating with the client computer 40.

[0037] Furthermore, the storage unit 36 ​​of the center device 30 stores in advance information on the connection destination of an Internet service that the client computer 40 uses by connecting to the public Internet network 4 on the public Internet network 4 for a limited period (e.g., several minutes) due to a predetermined operation of the center device 30. This information on the connection destination of the Internet service is, for example, a domain, ID, password, etc. of the connection destination of an Internet service such as a map service 6 or a security camera that is desired to be used in the event of a disaster at the guarded facility 8.

[0038] Next, the operation when a disaster occurs at the guarded facility 8 will be described. Note that the reference characters in parentheses in the following description correspond to the reference characters in the explanatory diagram of Fig. 3. First, when a suspicious person intrudes into the guarded facility 8 (disaster occurs) (S801), security information about the incident is sent from the security terminal 10 to the center device 30. In response to the disaster, the center device 30 sends to the client computer 40 connection destination information for the desired Internet service that the client wishes to use, which has been registered in advance in the storage unit 36 ​​(S3001).

[0039] The client computer 40, which has received the connection destination information of the desired Internet service from the center device 30, uses the sandbox instruction means 42a, which is a function of the control unit 42, to send an Internet connection request to the sandbox computer 60 (S4001), turn on the power of the sandbox computer 60 (S6001), and start up the sandbox computer 60. At this time, the client computer 40 sends the connection destination information of the desired Internet service received from the center device 30 to the sandbox computer 60 (only at this time is the client computer 40 and the sandbox computer 60 in a state in which they can exchange information with each other via the LAN switch 28).

[0040] The sandbox computer 60, which has received the domain, ID, password, etc., which are connection destination information for the desired Internet service, connects to the Internet service, such as the map service 6 or a security camera, by using the browsing means 62b, which is a function of the control unit 62 of the sandbox computer 60 (S601). At this time, the IP address analysis means 62a, which is a function of the control unit 62 of the sandbox computer 60, obtains the relationship between the domain and the IP address of the connected Internet service (S601) (S6002).

[0041] The sandbox computer 60 sends the relationship between the domain and the IP address of the Internet service to be connected, acquired by the IP address analysis means 62a, to the client computer 40. The client computer 40, which has received the relationship between the domain and the IP address of the Internet service, stores this information in the storage unit 46. The client computer 40 may store the relationship between the domain and the IP address of the Internet service received from the sandbox computer 60 in any file in the storage unit 46, but in particular, the client computer 40 stores the relationship in the HOSTS file 46a, which is a file that associates the domain and the IP address of the Internet service, by rewriting the HOSTS file 46a. At this point, the power supply of the sandbox computer 60 is turned off (S6003). By turning off the power supply, the sandbox computer 60 returns the internal settings to their original state.

[0042] After rewriting the HOSTS file 46a, the client computer 40 temporarily sets the IP address of the router 24 in the default gateway setting using the network setting means 42b, which is a function of the control unit 42 of the client computer 40, so that the client computer 40 can temporarily connect to the public Internet network 4 via the router 24 (S4003).

[0043] After these setting changes, the client computer 40 connects to the public Internet network 4 (S4004), and connects to a desired Internet service such as the map service 6 or a security camera by using the browsing means 42c, which is a function of the control unit 42 (S602). However, the only domains that the client computer 40 can connect to are those listed in the HOSTS file 46a.

[0044] When various countermeasures are completed (S4005) and the client computer 40 no longer needs to connect to the public Internet network 4, a process is performed to return the settings to disable the client computer 40 from connecting to the public Internet network 4. Specifically, the client computer 40 uses the network setting change means 42b to remove the information written in the HOSTS file 46a and initialize the contents of the HOSTS file 46a (S4006). The network setting change means 42b also deletes the IP address of the router 24 from the default gateway settings, disabling the client computer 40 from connecting to the public Internet network 4 via the router 24 (S4007).

[0045] According to the security center 20 described above, since it is connected to the public Internet network 4 only for a limited period of time, it is possible to reduce the risk of constant hacking and virus infection.

[0046] The present invention allows various embodiments and modifications without departing from the broad spirit and scope of the present invention. The above-described embodiments are for the purpose of explaining the present invention and do not limit the scope of the present invention. That is, the scope of the present invention is indicated by the claims, not the embodiments. Various modifications made within the scope of the claims and within the scope of the meaning of the invention equivalent thereto are considered to be within the scope of the present invention. [Industrial Applicability]

[0047] As described above, according to the present invention, it is possible to provide a security center and a method for controlling a security center that can reduce the risk of constant hacking and virus infection by connecting to a public Internet network only for a limited period of time. [Explanation of symbols]

[0048] 1. Security system 4. Public Internet Network 6. Map services 8. Security Facilities 10. Security terminal 20. Security Center 22...Router 24...Router 26...Router 28 LAN switch 30 Center device 32 Control section 34. Communications Department 36...Storage section 40 Client Computer 42 Control section 42a Sandbox instruction means 42b Network setting means 42c Browsing methods 44 Communications Department 46...Storage section 46a HOSTS File 50...Display section 52...Operation unit 60. Sandbox Computer 62...Control section 62a IP address analysis method 62b Browsing methods 64 Communications Department

Claims

1. A security center receives security information on a security situation from a security terminal that monitors the security situation of a facility to be secured via an electric communication line, and monitors the facility to be secured based on report information that is information necessary for security including the security information, a center device that receives the security information of the security target facility; a client computer that manages the security information received by the center device and is configured not to be connected to a public Internet network at all times; a sandbox computer connectable to the public Internet network; In response to a predetermined operation of the center device, the client computer sends to the sandbox computer destination information of a specific Internet service on the public Internet network that the client computer wishes to connect to, thereby connecting to the sandbox computer and acquiring a relationship between a domain and an IP address of the specific Internet service that the client computer wishes to connect to; The sandbox computer transmits the obtained relationship between the domain and the IP address of the specific Internet service to be connected to the client computer; the client computer connects to the public Internet network only during the period during which the specific Internet service to be connected is to be used, and connects to and uses the specific Internet service to be connected using the relationship between the domain and the IP address of the specific Internet service to be connected obtained from the sandbox computer; After the client computer finishes using the specific Internet service to which it wishes to connect, it will no longer be able to connect to the public Internet network. A security center characterized by:

2. The client computer includes: The security center described in claim 1, characterized in that the relationship between the domain and IP address of the specific Internet service to be connected obtained from the sandbox computer is recorded in a specified file, and the user can only connect to the specific Internet service to be connected to using the relationship between the domain and IP address recorded in the specified file, and when the connection to the specific Internet service to be connected to is terminated, the relationship between the domain and IP address of the specific Internet service to be connected to is deleted from the information in the specified file.

3. 3. The security center according to claim 2, wherein the predetermined file is a HOSTS file.

4. The security center according to any one of claims 1 to 3, characterized in that the sandbox computer stops operating or is turned off during periods when no interaction with the client computer is taking place.

5. a switch means for setting a limit on mutual exchange of information between the client computer and the sandbox computer; 5. The security center according to claim 1, wherein the information can be exchanged only when it is necessary.

6. The client computer includes: Normally, the network settings are set so that the default gateway and DNS server are not used so that the public Internet network cannot be connected, When connecting to the public Internet network and connecting to the specific Internet service to be connected, an IP address of a router means connected between the client computer and the public Internet network is temporarily set in the setting of the default gateway to enable connection to the public Internet network; A security center as described in any one of claims 1 to 5, characterized in that after the user has finished using the specific Internet service to which he or she wishes to connect, the default gateway is reset to its original setting to prevent the user from connecting to the public Internet network.

7. A method for controlling a security center that receives security information on a security situation from a security terminal that monitors the security situation of a security target facility via an electric communication line and monitors the security target facility based on report information that is information necessary for security including the security information, comprising: a client computer, which manages the security information received by the center device and cannot be connected to a public Internet network at all times, sends destination information of a specific Internet service on the public Internet network to be connected to a sandbox computer connects to the public Internet network in response to a predetermined operation of the center device receiving the security information of the security facility, and acquires a relationship between a domain and an IP address of the specific Internet service to be connected to, the client computer transmitting destination information of the specific Internet service on the public Internet network to a sandbox computer connects to the sandbox computer and acquires a relationship between a domain and an IP address of the specific Internet service to be connected to, The sandbox computer transmits the obtained relationship between the domain and the IP address of the specific Internet service to be connected to the client computer; the client computer connects to the public Internet network only during the period during which the specific Internet service to be connected is to be used, and connects to and uses the specific Internet service to be connected using the relationship between the domain and the IP address of the specific Internet service to be connected obtained from the sandbox computer; After the client computer finishes using the specific Internet service to which it wishes to connect, it will no longer be able to connect to the public Internet network.

23. A control method for a security center comprising:

8. The client computer, The control method for a security center as described in claim 7, characterized in that the relationship between the domain and IP address of the specific Internet service to be connected obtained from the sandbox computer is recorded in a specified file, and the specific Internet service to be connected to can only be connected to by the relationship between the domain and IP address recorded in the specified file, and when the connection to the specific Internet service to be connected to is terminated, the relationship between the domain and IP address of the specific Internet service to be connected to is deleted from the information in the specified file.

9. 9. The method for controlling a security center according to claim 8, wherein the predetermined file is a HOSTS file.

10. A control method for a security center described in any one of claims 7 to 9, characterized in that the sandbox computer stops operating or is turned off during a period when it is not interacting with the client computer.

11. 11. The control method for a security center according to claim 7, wherein the client computer and the sandbox computer are capable of exchanging information with each other only when such exchange is necessary.

12. The client computer, Normally, the network settings are set so that the default gateway and DNS server are not used so that the public Internet network cannot be connected, When connecting to the public Internet network and connecting to the specific Internet service to be connected, an IP address of a router means connected between the client computer and the public Internet network is temporarily set in the setting of the default gateway to enable connection to the public Internet network; The control method for a security center described in any one of claims 7 to 11, characterized in that after the user has finished using the specific Internet service to which the user wishes to connect, the default gateway settings are restored to their original state so that the user cannot connect to the public Internet network.

Images