JP6946829B2 - Programs, information processing methods and information processing equipment - Google Patents

Description

The present invention relates to programs, information processing methods and information processing devices.

Conventionally, there is known a device that is connected between the Internet and a specific server device provided outside the company intranet to be secured to prevent the infection of an unknown computer virus to the company intranet (for example). See Patent Documents 1 to 3).

Patent No. 4088082 Patent No. 3971353 Patent No. 4961153

However, there is a problem that the conventional technology cannot appropriately prevent the spread of malware.

One aspect is to provide a program or the like that can appropriately prevent the spread of malware.

In one plan, when malware is detected by the information processing device, detection information indicating that the malware has been detected is output to the management device that manages the information processing device, and after the detection information is output, the information processing is performed. The device blocks the interface connected to the external network, and the access destination of the first interface, process information, and the first interface that is blocked after the block is blocked, and the second interface that is different from the first interface that is not blocked. The information processing device is made to execute a process of displaying the access destination of the second interface in association with the display unit of the information processing device.

On one side, it is possible to adequately prevent the spread of malware.

It is explanatory drawing which shows the outline of an information processing system. It is a block diagram which shows the hardware group of a computer. It is explanatory drawing which shows the display image of the report information. It is a block diagram which shows the hardware group of a server computer. It is a block diagram which shows the hardware group of a terminal device. It is explanatory drawing which shows the record layout of the state DB. It is explanatory drawing which shows the display image of the blockage state. It is a flowchart which shows the output processing procedure of detection information. It is a flowchart which shows the output processing procedure of detection information. It is a block diagram which shows the hardware group of the server computer which concerns on Embodiment 2. It is a block diagram which shows the hardware group which concerns on Embodiment 2. It is explanatory drawing which shows the record layout of a security policy table. It is a flowchart which shows the procedure of the block processing. It is a flowchart which shows the procedure of the block processing. It is a flowchart which shows the display processing procedure. It is explanatory drawing which shows the image of the blocked state. It is a block diagram which shows the hardware group of the server computer which concerns on Embodiment 4. It is explanatory drawing which shows the record layout of the state DB. It is a flowchart which shows the output processing procedure of blockage information and release information. It is a flowchart which shows the output processing procedure of blockage information and release information. It is explanatory drawing which shows the display image of the blockage information and release information. It is explanatory drawing which shows the record layout of the state DB. It is a flowchart which shows the procedure of the block processing. It is a flowchart which shows the procedure of the block processing. It is a flowchart which shows the procedure of the block processing. It is a flowchart which shows the procedure of the block processing. It is a functional block diagram of the computer of the above-mentioned form. It is a functional block diagram which shows the operation of the server computer of the above-mentioned form. It is a block diagram which shows the hardware group of the computer which concerns on Embodiment 6. It is a block diagram which shows the hardware group of the server computer which concerns on Embodiment 6. It is a flowchart which shows the output processing procedure of detection information. It is a flowchart which shows the output processing procedure of detection information. It is a flowchart which shows the procedure of the block processing. It is a flowchart which shows the procedure of the block processing. It is a flowchart which shows the procedure of the block processing. It is a flowchart which shows the procedure of the block processing. It is a flowchart which shows the procedure of the block processing.

Embodiment 1
Hereinafter, embodiments will be described with reference to the drawings. FIG. 1 is an explanatory diagram showing an outline of an information processing system. The information processing system includes an information processing device 2, a management device 1, and a management device 3. The management device 1 that manages the information processing device 2 is, for example, a server computer or a personal computer. In the embodiment, the management device 1 will be replaced with the server computer 1 for description. The information processing device 2 is, for example, a personal computer, a smartphone, a mobile phone, a tablet, or the like. Hereinafter, the information processing device 2 will be referred to as a computer 2 and will be described.

The management device 3 that manages the computer 2 through the server computer 1 is a personal computer, a smartphone, a mobile phone, a tablet, or the like. The server computer 1, each computer 2, and the terminal device 3 are external networks such as the Internet, LAN (Local Area Network), Wi-Fi network, short-range wireless communication network such as Bluetooth (registered trademark), and communication network such as public network. They are interconnected via N. Although the example in which the server computer 1 and the management device 3 are provided is shown in the first embodiment, the computer 2 may be managed by either the server computer 1 or the management device 3.

The computer 2 detects malware by the installed antivirus software. When the computer 2 detects malware, it transmits detection information indicating that the malware has been detected to the server computer 1. After that, the computer 2 blocks the interface for connecting to the communication network N, which is an external network. The server computer 1 transmits the detection information to the management device 3 of the administrator. Details will be described below.

FIG. 2 is a block diagram showing a hardware group of the computer 2. The computer 2 includes a CPU (Central Processing Unit) 21 as a control unit, a RAM (Random Access Memory) 22, an input unit 23, a display unit 24, a storage unit 25, a clock unit 28, a communication unit 26, and the like. The CPU 21 is connected to each part of the hardware via the bus 27. The CPU 21 controls each hardware unit according to the control program 25P and the OS (Operating System) 251 stored in the storage unit 25. The CPU 21 may be a multi-core processor equipped with a plurality of processor cores. The RAM 22 is, for example, an SRAM (Static RAM), a DRAM (Dynamic RAM), a flash memory, or the like. The RAM 22 also functions as a storage unit, and temporarily stores various data generated when various programs are executed by the CPU 21.

The input unit 23 is an input device such as a mouse, keyboard, touch panel, and buttons, and outputs the received operation information to the CPU 21. The display unit 24 is a liquid crystal display, an organic EL (electroluminescence) display, or the like, and displays various information according to the instructions of the CPU 21. The communication unit 26 is a communication module that is an interface, and transmits / receives information to / from the server computer 1 and the like. The communication unit 26 is, for example, a LAN module 261 connected to the communication network N, a wireless communication unit 262 such as a Wi-Fi module, and a short-range communication module that performs short-range communication based on the Bluetooth standard, infrared communication, or the like. It is a short-range communication unit 263. The clock unit 28 outputs date and time information to the CPU 21. The storage unit 25 is a large-capacity memory or a hard disk, and stores the control program 25P and the like.

The CPU 21 detects malware by antivirus software stored in the storage unit 25. When the CPU 21 detects malware, it transmits detection information indicating that the malware has been detected to the server computer 1 via the LAN module 261. The CPU 21 then shuts down all interfaces including the LAN module 261, the wireless communication unit 262, and the short-range communication unit 263. Specifically, the OS 251 outputs a command to the communication unit 26 to block the interface. In this case, the blockage command prohibits transmission / reception of each communication unit 26, or cuts off the power supply, making it impossible to transmit / receive information. In addition, when a blockage command is received, each communication unit 26 may disable communication by performing a process of rewriting the transmission destination of information from each communication unit 26.

After the blockage is performed, the CPU 21 displays the access destination, the process information, and the blockage date and time when the communication unit 26 is blocked on the display unit 24 on the display unit 24. FIG. 3 is an explanatory diagram showing a display image of the report information. The CPU 21 displays the IP address of the computer 2, the detected date and time of malware, the detected malware, and the blocked date and time of the communication unit 26 on the display unit 24 as report information. The CPU 21 displays the date and time output from the antivirus software as the detection date and time. Further, when the closing of the communication unit 26 is completed, the output of the clock unit 28 is referred to and the closing date and time is displayed.

Further, the CPU 21 displays a protocol, a local address, an external address, process information, and the like based on the past communication log stored in the RAM 22 or the storage unit 25. As the protocol, the type of communication such as TCP (Transmission Control Protocol) is displayed. As the process information, information for identifying a process such as XX.exe or System, which is an executable file, is displayed. The local address is the IP address of computer 2 at the time of process execution. As the external address, the IP address or URL of the access destination at the time of process execution is displayed.

FIG. 4 is a block diagram showing a hardware group of the server computer 1. The server computer 1 includes a CPU 11, a RAM 12, an input unit 13, a display unit 14, a storage unit 15, a clock unit 18, a communication unit 16, and the like as control units. The CPU 11 is connected to each part of the hardware via the bus 17. The CPU 11 controls each hardware unit according to the control program 15P stored in the storage unit 15. The CPU 11 may be a multi-core processor equipped with a plurality of processor cores. The RAM 12 is, for example, an SRAM (Static RAM), a DRAM (Dynamic RAM), a flash memory, or the like. The RAM 12 also functions as a storage unit, and temporarily stores various data generated when various programs are executed by the CPU 11.

The input unit 13 is an input device such as a mouse, a keyboard, a touch panel, and a button, and outputs the received operation information to the CPU 11. The display unit 14 is a liquid crystal display, an organic EL display, or the like, and displays various information according to the instructions of the CPU 11. The communication unit 16 is a communication module, and transmits / receives information to / from a computer 2 or the like. The clock unit 18 outputs date and time information to the CPU 11. The storage unit 15 is a large-capacity memory or a hard disk, and stores the control program 15P and the like.

Further, in the embodiment, the server computer 1 will be described as a single unit, but the present invention is not limited to this. For example, it may be physically composed of a plurality of server computers 1, 1, ..., Or may be composed of a plurality of virtual machines. The CPU 11 of the server computer 1 receives the detection information and the identification information for identifying the computer 2 from the computer 2.

The computer 1 outputs a response request command such as a ping command to the computer 2 that has transmitted the detection information. If there is no response to the response request command, the CPU 11 determines that the blockage of the communication unit 26 of the computer 2 is completed. The CPU 11 transmits the received identification information, the detection information, and the blockage information indicating that the communication unit 26 of the computer 2 is blocked to the terminal device 3. The identification information may be, for example, a computer name, an IP address, a MAC (Media Access Control) address, or the like. In this embodiment, it will be described as being a computer name. Further, in the embodiment, an example in which the detection information and the blockage information are transmitted to the management device 3 is shown, but the present invention is not limited to this. The CPU 11 may transmit either the detection information or the blockage information.

FIG. 5 is a block diagram showing a hardware group of the terminal device 3. The terminal device 3 includes a CPU 31, a RAM 32, an input unit 33, a display unit 34, a storage unit 35, a clock unit 38, a communication unit 36, and the like as control units. The CPU 31 is connected to each part of the hardware via the bus 37. The CPU 31 controls each hardware unit according to the control program 35P stored in the storage unit 35. The CPU 31 may be a multi-core processor equipped with a plurality of processor cores. The RAM 32 is, for example, an SRAM, a DRAM, a flash memory, or the like. The RAM 32 also functions as a storage unit, and temporarily stores various data generated when various programs are executed by the CPU 31.

The input unit 33 is an input device such as a mouse, a keyboard, a touch panel, and a button, and outputs the received operation information to the CPU 31. The display unit 34 is a liquid crystal display, an organic EL display, or the like, and displays various information according to the instructions of the CPU 31. The communication unit 36 is a communication module and transmits / receives information to / from the server computer 1 and the like. The clock unit 38 outputs the date and time information to the CPU 31. The storage unit 35 is a large-capacity memory or a hard disk, and stores the control program 35P, the state DB 351 and the like.

FIG. 6 is an explanatory diagram showing a record layout of the state DB 351. The state DB 351 includes a monitored terminal field, a detection information field, a block information field, and the like. The computer name of the computer 2 to be monitored is stored in the monitored terminal field. In the detection information field, information as to whether or not the detection information has been received is stored in association with the computer name. In the blockage information field, information on whether or not the communication unit 26 of the computer 2 corresponding to the computer name is blocked is stored.

In the example of FIG. 6, the detection information is not detected in the terminal 2, and the blockage information is stored as non-blockage. On the other hand, in the terminal 1, the detection information is stored as detection and the blockage information is also stored as blockage as the malware is detected. When the CPU 31 of the terminal device 3 receives the computer name, detection information, and blockage information from the server computer 1, the CPU 31 changes the detection information from non-detection to detection in association with the computer name in the state DB 351 and does not block the blockage information. Change from to blockage.

FIG. 7 is an explanatory diagram showing a display image of a blocked state. The CPU 31 of the management device 3 refers to the state DB 351 and displays the computer name, detection information, and blockage information on the display unit 34.

In the above hardware group, various software processes will be described with reference to a flowchart. 8 and 9 are flowcharts showing the output processing procedure of the detection information. The CPU 21 of the computer 2 determines whether or not malware has been detected (step S81). If the CPU 21 determines that the detection has not been performed (NO in step S81), the CPU 21 repeats the process of step S81. When the CPU 21 determines that malware has been detected (YES in step S81), the CPU 21 shifts the process to step S82.

The CPU 21 transmits the detection information and the computer name to the server computer 1 (step S82). The CPU 21 issues an OS command to the effect that the communication unit 26 should be closed, and closes the communication unit 26 (step S84). The CPU 11 of the server computer 1 receives the detection information and the computer name (step S83). The CPU 11 transmits a response request command to the computer 2 (step S85). The CPU 11 determines whether or not there is a response to the response request command (step S86). When the CPU 11 determines that there is a response (NO in step S86), the CPU 11 returns the process to step S85 and repeats the process.

When the CPU 11 determines that there is no response (YES in step S86), the CPU 11 shifts the process to step S87. The CPU 11 transmits the computer name, the detection information, and the blockage information to the management device 3 (step S87). The CPU 31 of the management device 3 receives the computer name, detection information, and blockage information (step S88). The CPU 31 stores the computer name, detection information, and blockage information in the state DB 351 (step S89). The CPU 31 displays the computer name, detection information, and blockage information stored in the state DB 351 on the display unit 34 (step S91).

The computer 2 displays the IP address, the date and time when the malware was detected, and the detected malware on the display unit 24 as the report information (step S92). The date and time of malware detection and the detected malware may be displayed based on the information output from the antivirus software. The CPU 21 displays the process information stored in the RAM 22, the protocol at each process, and the time-series data of the local address and the external address on the display unit 24 (step S93). As a result, it is possible to prevent the spread of malware. Further, by using the OS command, it is possible to appropriately block the communication unit 26. Further, the user can easily grasp the state at the time of malware detection on the computer 2 side. Further, the management device 3 side can also appropriately grasp the current detection and blockage status.

Embodiment 2
The second embodiment relates to a mode for determining a communication unit 26 to be blocked based on a security policy. FIG. 10 is a block diagram showing a hardware group of the server computer 1 according to the second embodiment. A security policy table 352 is newly provided in the storage unit 15. FIG. 11 is a block diagram showing a hardware group according to the second embodiment. A security policy table 252 is newly provided in the storage unit 25.

FIG. 12 is an explanatory diagram showing a record layout of the security policy table 352. The security policy table 352 includes an ID field, a policy field, and the like. In the ID field, identification information (ID) for identifying an event corresponding to the detected malware is stored. In the example of FIG. 12, "M01" and "M02" are stored as IDs. For example, the ID "M01" is issued to the malware A, and the ID "M02" is issued to the malware B different from the malware A. In the policy field, blocked or non-blocked information is stored in association with the ID for each type of communication unit 26.

In the example of FIG. 12, blocked or non-blocked information is stored in association with the ID of the LAN module 261, the wireless communication unit 262, and the short-range communication unit 263. For example, for the ID "M01", the LAN module 261 is stored as closed, the wireless communication unit 262 is stored as closed, and the short-range communication unit 263 is stored as non-blocked. Further, regarding the ID "M02", in the present embodiment, all of the LAN module 261 and the wireless communication unit 262 and the short-range communication unit 263 are stored as non-blocked. The stored contents of the security policy table 352 can be appropriately changed by the administrator through the input unit 33.

The stored contents of the security policy table 352 created by the management device 3 are transmitted to the server computer 1 and the computer 2. When the storage content of the security policy table 352 is transmitted from the management device 3, the CPU 21 of the computer 2 stores the same content in the security policy table 252. When the CPU 21 detects malware, it acquires an ID issued in response to the malware output from the antivirus software. The CPU 21 refers to the security policy table 252 and reads out the blocked or non-blocked information of each communication unit 26 corresponding to the ID. The CPU 21 blocks or does not block each communication unit 26 based on the read information. The security policy table may be stored in the storage unit 15 of the server computer 1.

13 and 14 are flowcharts showing the procedure of the blocking process. The CPU 31 of the management device 3 receives the security policy through the input unit 33, and stores the received security policy in the security policy table 352 (step S131). The CPU 31 transmits the security policy stored in the security policy table 352 to the computer 2 (step S132). The CPU 21 receives the transmitted security policy and stores it in the security policy table 252 (step S133).

The CPU 21 of the computer 2 determines whether or not malware has been detected (step S134). If the CPU 21 determines that the detection has not been performed (NO in step S134), the CPU 21 repeats the process of step S134. When the CPU 21 determines that malware has been detected (YES in step S134), the CPU 21 shifts the process to step S135.

The CPU 21 transmits the detection information and the computer name to the server computer 1 (step S135). The CPU 11 of the server computer 1 receives the detection information and the computer name (step S136).

The CPU 21 reads the security policy corresponding to the ID issued corresponding to the malware name from the security policy table 252 (step S137). The CPU 21 blocks or does not block each communication unit 26 according to the security policy (step S138). Specifically, the CPU 21 individually issues an OS command to the communication unit 26 to be blocked. When the communication unit 26 receives an OS command to the effect that it should be blocked, the communication unit 26 performs a blocking process.

The CPU 11 of the server computer 1 transmits a response request command to the computer 2 (step S139). Since the subsequent processing is as described in the first embodiment, detailed description thereof will be omitted. As a result, it is possible to perform an operation in which the communication unit 26 to be blocked is specified according to the security policy.

Embodiment 3
The third embodiment relates to a form in which the blocked communication unit 26 and the access destination are displayed. FIG. 15 is a flowchart showing a display processing procedure. The CPU 21 acquires an access destination when malware is detected in the blocked communication unit 26 based on the security policy (step S151). Further, the CPU 21 acquires an access destination when the blocked communication unit 26 is blocked (step S152). As described with respect to the report information shown in FIG. 3, the CPU 21 stores the protocol, local address, access destination, process information, and the like at the time of communication in the RAM 22 in chronological order, and at the time of detecting malware and at the time of blocking. Read the access destination. In the embodiment, the access destination is an IP address, but a URL, a MAC address, or the like may be used.

The CPU 21 displays the blocked communication unit 26 on the display unit 24 (step S153). The CPU 21 displays the access destination at the time of malware detection and the access destination at the time of blockage on the display unit 24 in association with the blocked communication unit 26 (step S154). FIG. 16 is an explanatory diagram showing an image of a blocked state. In the example of FIG. 16, the blocked state is shown, and it can be seen that the blocked communication unit 26 is the LAN module 261 and the wireless communication unit 262. Further, for the LAN module 261, the access destination at the time of malware detection and the access destination at the time of blockage are displayed respectively. Similarly, the access destination when malware is detected and the access destination when blocked by the wireless communication unit 262 are displayed. Although an example is shown in which both the access destination at the time of malware detection and the access destination at the time of blockage are described, either one may be used.

Subsequently, the CPU 21 displays the communication unit 26 and the access destination that are not blocked (step S155). In the example of FIG. 16, the short-range communication unit 263 is displayed as the communication unit 26 that is not blocked, and the access destination during communication is displayed at the same time. This makes it possible to easily grasp the blockage status. In addition, it is possible to easily identify the access destination when malware is detected or blocked.

The third embodiment is as described above, and the other parts are the same as those of the first or second embodiment. Therefore, the same reference numbers are assigned to the corresponding parts, and detailed description thereof will be omitted.

Embodiment 4
The fourth embodiment relates to a mode in which release information indicating that the blockage has been released is displayed. FIG. 17 is a block diagram showing a hardware group of the server computer 1 according to the fourth embodiment. The storage unit 15 is further provided with a state DB 151.

FIG. 18 is an explanatory diagram showing a record layout of the state DB 151. The state DB 151 includes a monitored terminal field, a detection information field, a date and time field, a blockage information field, a release information field, and the like. The computer name of the computer 2 belonging to the same network is stored in the monitored terminal field. Specifically, among the IP addresses, the computer names of the computers 2, 2, ... Having the same network address are stored as the computers 2 belonging to the same network. The operator may register the computer 2 belonging to the same network in the state DB 151 via the input unit 13 or the communication unit 16. Further, not only computers 2, 2 ... Belonging to the same segment but also computers 2, 2 ... Belonging to a plurality of specified segments may be registered as computers 2 belonging to the same network. Further, in the present embodiment, the blockage information and the release information of the computer 2 belonging to another network may be stored.

In the detection information field, information on whether or not malware has been detected is stored in association with the computer name. In the date and time field, the date and time when malware was detected or the date and time when the block was released is stored in association with the computer name. It should be noted that the date and time of the blockage may be stored instead of the date and time when the malware was detected. In the blockage information field, blocked or non-blocked information is stored in association with the computer name and the detection date and time. In the release information field, information on whether or not the release is made is stored in association with the computer name and the release date and time.

19 and 20 are flowcharts showing the output processing procedure of the blockage information and the release information. The CPU 21 of the computer 2 determines whether or not malware has been detected (step S191). If the CPU 21 determines that the detection has not been performed (NO in step S191), the CPU 21 repeats the process of step S191. When the CPU 21 determines that malware has been detected (YES in step S191), the CPU 21 shifts the process to step S192.

The CPU 21 transmits the detection information and the computer name to the server computer 1 (step S192). The CPU 21 closes the communication unit 26 (step S195). The CPU 11 of the server computer 1 receives the detection information and the computer name (step S193). The CPU 11 stores the computer name, the detection information, and the detection date and time in the state DB 151 (step S194). As the detection date and time, in addition to the date and time output from the clock unit 18 when the detection information is received, the detection date and time transmitted together with the detection information from the computer 2 may be used.

The CPU 11 transmits a response request command to the computer 2 (step S196). The CPU 11 determines whether or not there is a response to the response request command (step S197). When the CPU 11 determines that there is a response (NO in step S197), the CPU 11 returns the process to step S196 and repeats the process.

When the CPU 11 determines that there is no response (YES in step S197), the CPU 11 shifts the process to step S198. The CPU 11 stores the blockage information in the state DB 151 in association with the computer name and the detection date and time (step S198). After that, the repair work of the computer 2 proceeds, and the administrator inputs the release process for releasing the blockage through the input unit 23 or the like. The CPU 21 determines whether or not the release process has been accepted through the input unit 23 (step S199).

When the CPU 21 determines that the release process is not accepted (NO in step S199), the CPU 21 repeats the process until the release process is accepted. When the CPU 21 determines that the release process has been accepted (YES in step S199), the CPU 21 shifts the process to step S201. The CPU 21 transmits the computer name and the release information to the server computer 1 (step S201). The CPU 21 releases the blockage of the communication unit 26 (step S2011). The CPU 11 of the server computer 1 receives the computer name and the release information (step S202). The CPU 11 stores the release date and time and the release information in the state DB 151 in association with the computer name (step S203).

The CPU 11 transmits the stored contents of the state DB 151 to the management device 3 (step S204). The stored contents of the state DB 151 may be transmitted to the management device 3 every time the stored contents are updated or at predetermined time intervals. Further, the CPU 11 may delete the record related to the computer name and rewrite the undetected and blocked information as non-blocked as the detected information when several days have passed after storing the release information.

The CPU 31 of the management device 3 receives the stored contents of the state DB 151 (step S205). The CPU 31 displays the stored contents of the state DB 151 on the display unit 34 (step S206). FIG. 21 is an explanatory diagram showing a display image of blockage information and release information. When the CPU 31 receives the display instruction through the input unit 23 of the administrator, the CPU 31 reads out the contents of the state DB 151 stored in the storage unit 35 and displays the contents on the display unit 34. Specifically, the CPU 11 displays the computer name, detection information, date and time, blockage information, and release information.

When the blocked computer name exists, the CPU 31 may extract the blocked computer name and display information that calls attention. In the example of FIG. 21, the name of the blocked computer is extracted and displayed as "Terminal 1 is blocked." As a result, the administrator can easily check the blocked and released states of the computers 2 belonging to the same network.

The fourth embodiment is as described above, and the other parts are the same as those of the first to third embodiments. Therefore, the same reference numbers are assigned to the corresponding parts, and detailed description thereof will be omitted.

Embodiment 5
Embodiment 5 relates to a prophylactically occluded form. FIG. 22 is an explanatory diagram showing a record layout of the state DB 151. In the blockage information field of the state DB 151, two types of blockage and preventive blockage are stored. Preventive blockage is caused by another computer 2 (hereinafter, sometimes referred to as the second computer 2) belonging to the same network that has acquired the detection information through the computer 2 (hereinafter, sometimes referred to as the first computer 2) that has detected the malware. Indicates obstruction.

In the example of FIG. 22, the terminal 1 detects malware and blocks the communication unit 26. The terminal 2 and the terminal 3 indicate that the communication unit 26 is prophylactically blocked through the detection information from the terminal 1. Since other stored contents are the same as those of the other embodiments, detailed description thereof will be omitted.

23 to 26 are flowcharts showing the procedure of the blocking process. The CPU 21 of the first computer 2 determines whether or not malware has been detected (step S231). When the CPU 21 determines that the detection has not been performed (NO in step S231), the CPU 21 repeats the process of step S231. When the CPU 21 determines that malware has been detected (YES in step S231), the CPU 21 shifts the process to step S232.

The CPU 21 transmits the detection information and the name of the first computer to the second computer 2 and the server computer 1 (step S232). Specifically, the CPU 21 of the first computer 2 may read the address of the computer 2 belonging to the same network stored in advance in the storage unit 25, and transmit the first computer name and the detection information to the read computer 2. In addition, the server computer 1 or the management device 3 that has received the detection information and the first computer name may transmit the detection information and the first computer name to the second computer 2 having the same network address.

The CPU 21 of the first computer 2 closes the communication unit 26 (step S233). The CPU 21 of the second computer 2 receives the detection information and the name of the first computer (step S234). The CPU 11 of the server computer 1 receives the detection information and the name of the first computer (step S235). The CPU 11 stores the first computer name, the detection information, and the detection date and time in the state DB 151 (step S236).

The CPU 11 of the server computer 1 transmits a response request command to the first computer 2 (step S237). The CPU 11 determines whether or not there is a response to the response request command (step S238). When the CPU 11 determines that there is a response (NO in step S238), the CPU 11 returns the process to step S237 and repeats the process.

When the CPU 11 determines that there is no response (YES in step S238), the CPU 11 shifts the process to step S239. The CPU 11 stores the blockage information in the state DB 151 in association with the first computer name and the detection date and time (step S239).

The CPU 21 of the second computer 2 transmits the second computer name and preventive blockage information to the server computer 1 (step S241). The CPU 21 of the second computer 2 closes the communication unit 26 (step S242). As a result, the communication units 26 of the plurality of computers 2 belonging to the same network are blocked.

The CPU 11 of the server computer 1 receives the second computer name and preventive blockage information (step S243). The CPU 11 of the server computer 1 transmits a response request command to the second computer 2 (step S2431). The CPU 11 determines whether or not there is a response to the response request command (step S2432). When the CPU 11 determines that there is a response (NO in step S2432), the CPU 11 returns the process to step S2431 and repeats the process. When the CPU 11 determines that there is no response (YES in step S2432), the CPU 11 shifts the process to step S244. The CPU 11 stores the second computer name, the blockage date and time, and preventive blockage information in the state DB 151 (step S244). Instead of the blockage date and time, the detection date and time stored in step S236 may be stored. After that, the repair work of the first computer 2 proceeds, and the administrator inputs the release process for releasing the blockage through the input unit 23 or the like. The CPU 21 of the first computer 2 determines whether or not the release process has been accepted through the input unit 23 (step S245).

When the CPU 21 determines that the release process is not accepted (NO in step S245), the CPU 21 repeats the process until the release process is accepted. When the CPU 21 determines that the release process has been accepted (YES in step S245), the CPU 21 shifts the process to step S246. The CPU 21 of the first computer 2 transmits the first computer name and the release information to the second computer 2 and the server computer 1 (step S246). The CPU 21 releases the blockage of the communication unit 26 (step S247).

The CPU 21 of the second computer 2 receives the first computer name and the release information (step S248). The CPU 21 releases the blockage of the communication unit 26 (step S249). The CPU 21 transmits the second computer name and the release information (step S251). The CPU 11 of the server computer 1 receives the first computer name, the second computer name, and the release information (step S252). The CPU 11 stores the release date and time and the release information in the state DB 151 in association with each computer name (step S253).

The CPU 11 transmits the stored contents of the state DB 151 to the management device 3 (step S254). The CPU 31 of the management device 3 receives the stored contents of the state DB 151 (step S255). The CPU 31 displays the stored contents of the state DB 151 on the display unit 34 (step S256). This makes it possible to prevent the spread of malware to computers 2 belonging to the same network. In addition, the right holder can grasp which computer 2 is blocked and which computer 2 is blocked prophylactically.

The fifth embodiment is as described above, and the other parts are the same as those of the first to fourth embodiments. Therefore, the same reference numbers are assigned to the corresponding parts, and detailed description thereof will be omitted.

Embodiment 6
FIG. 27 is a functional block diagram of the computer 2 of the above-described form. When the CPU 21 executes the control program 25P, the computer 2 operates as follows. When the output unit 271 detects malware, it outputs detection information indicating that the malware has been detected to the management device 3. After outputting the detection information, the blocking unit 272 closes the communication unit 26 connected to the external network.

FIG. 28 is a functional block diagram showing the operation of the server computer 1 in the above-described form. When the CPU 11 executes the control program 15P, the server computer 1 operates as follows. When the acquisition unit 281 detects malware, the acquisition unit 281 acquires detection information indicating that the malware transmitted before the blockage is detected from the computer 2 that blocks the communication unit 26 connected to the external network. When the output unit 282 receives the detection information, the output unit 282 outputs the detection information and the blockage information indicating that the blockage has occurred.

FIG. 29 is a block diagram showing a hardware group of the computer 2 according to the sixth embodiment. The program for operating the computer 2 causes the storage unit 25 to read the portable recording medium 2A such as a CD-ROM, a DVD disc, a memory card, or a USB memory by the reading unit 20A such as a disk drive or a memory card slot. You may remember. Further, a semiconductor memory 2B such as a flash memory storing the program may be mounted in the computer 2. Further, the program can also be downloaded from another server computer (not shown) connected via a communication network N such as the Internet. The contents will be described below.

The computer 2 shown in FIG. 29 reads a program for executing various software processes described above from the portable recording medium 2A or the semiconductor memory 2B, or downloads the program from another server computer (not shown) via the communication network N. do. The program is installed as a control program 25P, loaded into the RAM 22 and executed. As a result, it functions as the computer 2 described above.

FIG. 30 is a block diagram showing a hardware group of the server computer 1 according to the sixth embodiment. The program for operating the server computer 1 is a storage unit 15 in which a reading unit 10A such as a disk drive or a memory card slot is made to read a portable recording medium 1A such as a CD-ROM, a DVD disk, a memory card, or a USB memory. You may remember it in. Further, a semiconductor memory 1B such as a flash memory in which the program is stored may be mounted in the computer 1. Further, the program can also be downloaded from another server computer (not shown) connected via a communication network N such as the Internet. The contents will be described below.

The server computer 1 shown in FIG. 30 reads a program for executing various software processes described above from the portable recording medium 1A or the semiconductor memory 1B, or from another server computer (not shown) via the communication network N. to download. The program is installed as a control program 15P, loaded into the RAM 12, and executed. As a result, it functions as the server computer 1 described above.

The sixth embodiment is as described above, and the other parts are the same as those of the first to fifth embodiments. Therefore, the same reference numbers are assigned to the corresponding parts, and detailed description thereof will be omitted.

Embodiment 7
The seventh embodiment relates to a mode in which the state DB 151 is provided on the server computer 1. Although the first embodiment shows an example in which the state DB 353 is provided in the management device 3, the state DB 151 may be provided in the server computer 1. 31 and 32 are flowcharts showing the output processing procedure of the detection information. The CPU 21 of the computer 2 determines whether or not malware has been detected (step S311). When the CPU 21 determines that the detection has not been performed (NO in step S311), the CPU 21 repeats the process of step S311. When the CPU 21 determines that malware has been detected (YES in step S311), the CPU 21 shifts the process to step S312.

The CPU 21 transmits the detection information and the computer name to the server computer 1 (step S312). The CPU 21 issues an OS command to the effect that the communication unit 26 should be blocked, and blocks the communication unit 26 (step S314). The CPU 11 of the server computer 1 receives the detection information and the computer name (step S313). The CPU 11 transmits a response request command to the computer 2 (step S315). The CPU 11 determines whether or not there is a response to the response request command (step S316). When the CPU 11 determines that there is a response (NO in step S316), the CPU 11 returns the process to step S315 and repeats the process.

When the CPU 11 determines that there is no response (YES in step S316), the CPU 11 shifts the process to step S317. The CPU 11 stores the computer name, detection information, and blockage information in the state DB 151 (step S317). The CPU 11 transmits the computer name, the detection information, and the blockage information to the management device 3 (step S318). The CPU 31 of the management device 3 receives the computer name, detection information, and blockage information (step S319). The CPU 31 displays the received computer name, detection information, and blockage information on the display unit 34 (step S321).

The computer 2 displays the IP address, the date and time when the malware was detected, and the detected malware on the display unit 24 as the report information (step S322). The date and time of malware detection and the detected malware may be displayed based on the information output from the antivirus software. The CPU 21 displays the process information stored in the RAM 22, the protocol at each process, and the time-series data of the local address and the external address on the display unit 24 (step S323). This makes it possible to prevent the spread of malware.

The seventh embodiment is as described above, and the other parts are the same as those of the first to sixth embodiments. Therefore, the same reference numbers are assigned to the corresponding parts, and detailed description thereof will be omitted.

Embodiment 8
The eighth embodiment relates to a mode in which the detection information is transmitted to another computer 2 through the server computer 1. 33 to 37 are flowcharts showing the procedure of the blocking process. The CPU 21 of the first computer 2 determines whether or not malware has been detected (step S331). If the CPU 21 determines that the detection has not been performed (NO in step S331), the CPU 21 repeats the process of step S331. When the CPU 21 determines that malware has been detected (YES in step S331), the CPU 21 shifts the process to step S332.

The CPU 21 transmits the detection information and the first computer name to the server computer 1 (step S332). The CPU 21 of the first computer 2 closes the communication unit 26 (step S333). The CPU 11 of the server computer 1 receives the detection information and the name of the first computer (step S334). The CPU 11 stores the first computer name, the detection information, and the detection date and time in the state DB 151 (step S335).

The CPU 11 of the server computer 1 transmits a response request command to the first computer 2 (step S336). The CPU 11 determines whether or not there is a response to the response request command (step S337). When the CPU 11 determines that there is a response (NO in step S337), the CPU 11 returns the process to step S336 and repeats the process.

When the CPU 11 determines that there is no response (YES in step S337), the CPU 11 shifts the process to step S338. The CPU 11 stores the blockage information in the state DB 151 in association with the first computer name and the detection date and time (step S338).

The CPU 11 outputs a blocking command indicating that the communication unit 26 is blocked to the second computer 2 belonging to the same network as the first computer 2 (step S339). The CPU 21 of the second computer 2 receives the block instruction (step S341). The CPU 21 transmits the second computer name and preventive blockage information to the server computer 1 (step S342). The CPU 21 of the second computer 2 closes the communication unit 26 (step S343). In the embodiment, in order to facilitate the explanation, an example of outputting a block instruction to one second computer 2 is shown, but the present invention is not limited to this. Similarly, the block instruction may be output to a plurality of other third computers 2, the fourth computer 2, and the like. As a result, the communication units 26 of the plurality of computers 2 belonging to the same network are blocked.

The CPU 11 of the server computer 1 receives the second computer name and preventive blockage information (step S344). The CPU 11 of the server computer 1 transmits a response request command to the second computer 2 (step S345). The CPU 11 determines whether or not there is a response to the response request command (step S346). When the CPU 11 determines that there is a response (NO in step S346), the CPU 11 returns the process to step S345 and repeats the process. When the CPU 11 determines that there is no response (YES in step S346), the CPU 11 shifts the process to step S347. The CPU 11 stores the second computer name, the blockage date and time, and preventive blockage information in the state DB 151 (step S347). After that, the repair work of the first computer 2 proceeds, and the administrator inputs the release process for releasing the blockage through the input unit 23 or the like. The CPU 21 of the first computer 2 determines whether or not the release process has been accepted through the input unit 23 (step S348).

When the CPU 21 determines that the release process is not accepted (NO in step S348), the CPU 21 repeats the process until the release process is accepted. When the CPU 21 determines that the release process has been accepted (YES in step S348), the CPU 21 shifts the process to step S349. The CPU 21 of the first computer 2 transmits the first computer name and the release information to the server computer 1 (step S349). The CPU 21 releases the blockage of the communication unit 26 (step S351).

The CPU 11 of the server computer 1 receives the first computer name and the release information (step S352). The CPU 11 transmits a release command to the second computer 2 (step S353). The CPU 21 of the second computer 2 receives the release command (step S354). The CPU 21 of the second computer 2 releases the blockage of the communication unit 26 (step S355). The CPU 21 transmits the second computer name and the release information (step S356). The CPU 11 receives the second computer name and the release information (step S357). The CPU 11 stores the release date and time and the release information in the state DB 151 in association with each computer name (step S358).

The CPU 11 transmits the stored contents of the state DB 151 to the management device 3 (step S359). The CPU 31 of the management device 3 receives the stored contents of the state DB 151 (step S361). The CPU 31 displays the stored contents of the state DB 151 on the display unit 34 (step S362). This makes it possible to prevent the spread of malware between the computers 2 belonging to the same network. In addition, the release can be easily executed between the computers 2.

The eighth embodiment is as described above, and the other parts are the same as those of the first to seventh embodiments. Therefore, the same reference numbers are assigned to the corresponding parts, and detailed description thereof will be omitted. It should be noted that each of the above-described embodiments can be combined as appropriate.

The following additional notes will be further disclosed with respect to the embodiments including the above embodiments 1 to 8.
(Appendix 1)
When malware is detected by the information processing device, detection information indicating that the malware has been detected is output to the management device that manages the information processing device.
A program that causes the information processing device to execute a process of blocking an interface connected to an external network by the information processing device after outputting the detection information.
(Appendix 2)
The program described in Appendix 1 that refers to a security policy stored in advance and determines which of a plurality of interfaces is blocked according to the detected malware.
(Appendix 3)
The program according to Appendix 1 or 2, which performs a process of blocking by issuing an OS command.
(Appendix 4)
The program according to any one of Supplementary note 1 to 3, which outputs report information including the access destination, process information, and the date and time when the interface was closed after blocking.
(Appendix 5)
The program according to any one of Appendix 1 to 4, which outputs the blocked interface and access destination after blocking.
(Appendix 6)
The program according to any one of Appendix 1 to 4, which outputs an interface and an access destination that has been blocked after being blocked and an interface and an access destination that has not been blocked.
(Appendix 7)
Obtain detection information through other information processing devices belonging to the same network,
The program according to any one of Supplementary note 1 to 6, which blocks the interface when the detection information is acquired.
(Appendix 8)
When malware is detected, the information processing device that blocks the interface connected to the external network acquires the detection information indicating that the malware sent before the blockage was detected.
A program that causes a computer to execute a process that outputs detection information and blockage information indicating blockage when detection information is received.
(Appendix 9)
The program according to Appendix 8 that outputs identification information for identifying the information processing device, the detection information, and blockage information.
(Appendix 10)
Obtaining release information indicating that the interface is released from the information processing device,
The program according to Appendix 8 or 9, which outputs the identification information and the release information of the information processing device when the release information is acquired.
(Appendix 11)
The detection information is acquired from another information processing device belonging to the same network as the information processing device, and the detection information is acquired.
The program according to any one of Appendix 8 to 10, which outputs identification information, detection information, and blockage information of the other computer.
(Appendix 12)
Obtaining the second release information indicating that the interface blockage has been released from the other information processing device,
The program according to Appendix 11, which outputs the identification information of the other information processing apparatus and the second release information when the second release information is acquired.
(Appendix 13)
When the second blockage information indicating that the interface of the information processing device is blocked is acquired from the information document processing device as the detection information is acquired from another information processing device belonging to the same network, the said The program according to any one of Appendix 8 to 12, which outputs the identification information and the second blockage information of the information processing device.
(Appendix 14)
The description in any one of Appendix 8 to 12, which outputs a blocking command for blocking the interface to another information processing device belonging to the same network as the information processing device when the detection information is acquired from the information processing device. program.
(Appendix 15)
When malware is detected by the information processing device, detection information indicating that the malware has been detected is output to the management device that manages the information processing device.
An information processing method in which the information processing device executes a process of blocking an interface connected to an external network after the detection information is output.
(Appendix 16)
When malware is detected, an output unit that outputs detection information indicating that the malware has been detected to the management device, and an output unit.
An information processing device including a blocking portion that blocks an interface connected to an external network after outputting the detection information.
(Appendix 17)
When malware is detected, the information processing device that blocks the interface connected to the external network acquires the detection information indicating that the malware sent before the blockage was detected.
An information processing method that causes a computer to execute a process that outputs the detection information and the blockage information indicating that the blockage has occurred when the detection information is received.
(Appendix 18)
When malware is detected, an acquisition unit that acquires detection information indicating that malware transmitted before the blockage was detected from an information processing device that blocks the interface connected to the external network, and an acquisition unit.
An information processing device including an output unit that outputs detection information and blockage information indicating that the blockage has occurred when the detection information is received.

1 Server computer (information processing device)
2 Computer 3 Management device 1A Portable recording medium 1B Semiconductor memory 10A Reading unit 2A Portable recording medium 2B Semiconductor memory 20A Reading unit 11 CPU
12 RAM
13 Input unit 14 Display unit 15 Storage unit 15P Control program 16 Communication unit 18 Clock unit 21 CPU
22 RAM
23 Input unit 24 Display unit 25 Storage unit 25P Control program 26 Communication unit 28 Clock unit 31 CPU
32 RAM
33 Input unit 34 Display unit 35 Storage unit 35P Control program 36 Communication unit 38 Clock unit 151 Status DB
251 OS
252 Security policy table 261 LAN module 262 Wireless communication unit 263 Short-range communication unit 271 Output unit 272 Blocking unit 281 Acquisition unit 282 Output unit 351 Status DB
352 Security Policy Table N Communication Network

Claims (9)

When malware is detected by the information processing device, detection information indicating that the malware has been detected is output to the management device that manages the information processing device.
After outputting the detection information, the information processing device blocks the interface connected to the external network, and then blocks the interface .
Information processing is performed on the access destinations of the first interface, process information, and the first interface that are blocked after the blockage, and the access destinations of the second interface and the second interface that are different from the first interface that is not blocked. A program that causes the information processing device to execute a process of displaying in association with a display unit of the device. The program according to claim 1, which refers to a security policy stored in advance and determines which of a plurality of interfaces is blocked according to the detected malware. The program according to claim 1 or 2, which performs a process of blocking by issuing an OS command. The program according to any one of claims 1 to 3, which outputs report information including an access destination, process information, and a date and time when the interface is closed after blocking. When malware is detected, the first detection information indicating that the malware has been detected is output.
After outputting the first detection information, the interface connected to the external network is closed, and the interface is closed.
Second detection information indicating that different second information processing devices belonging to the same network have detected malware is acquired from the second information processing device.
A program that causes a computer to execute a process of blocking the interface when the second detection information is acquired before the first detection information is output. When malware is detected by the information processing device, detection information indicating that the malware has been detected is output to the management device that manages the information processing device.
After outputting the detection information, the information processing device blocks the interface connected to the external network, and then blocks the interface .
Information processing is performed on the access destinations of the first interface, process information, and the first interface that are blocked after the blockage, and the access destinations of the second interface and the second interface that are different from the first interface that is not blocked. An information processing method for causing the information processing device to execute a process of displaying in association with a display unit of the device. When malware is detected, an output unit that outputs detection information indicating that the malware has been detected to the management device, and an output unit.
After outputting the detection information, and a closing portion for closing the interface connected to an external network,
A display that displays the access destinations of the first interface, process information, and the first interface that have been blocked after the blockage, and the access destinations of the second interface and the second interface that are different from the first interface that has not been blocked. An information processing device equipped with a unit. When malware is detected, the first detection information indicating that the malware has been detected is output.
After outputting the first detection information, the interface connected to the external network is closed, and the interface is closed.
Second detection information indicating that different second information processing devices belonging to the same network have detected malware is acquired from the second information processing device.
An information processing method in which a computer executes a process of blocking the interface when the second detection information is acquired before the first detection information is output. When malware is detected, an output unit that outputs the first detection information indicating that the malware has been detected, and an output unit.
After outputting the first detection information, the first blocking portion that blocks the interface connected to the external network and
An acquisition unit that acquires second detection information indicating that different second information processing devices belonging to the same network have detected malware from the second information processing device, and an acquisition unit.
An information processing device including a second blocking portion that blocks the interface when the second detection information is acquired before outputting the first detection information.

Images