SECURITY SYSTEM

• US 20170331853A1
• Filed: 03/10/2017
• Published: 11/16/2017
• Est. Priority Date: 05/11/2016
• Status: Active Application

• Current Assignee: Allied Telesis Holdings KK
• Original Assignee: Allied Telesis Holdings KK
• Inventors: Kawakita, Jun
• Application Number:
  US15/456,192
• Publication Number:
  US 20170331853A1
• Time in Patent Office: Days
• CPC Class Codes: H04L 2463/121 Timestamp cryptographic mechanisms or cryptographic arrangements involving time stamps H04L9/3297
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

A security system which performs predetermined control processing to a computer in a private network and is provided outside the private network, in which the security system which receives a global address which is a target of a threat from a threat detection system which detects the threat from an illegal attack server, specifies a local address corresponding to the received global address by referring to, based on the received global address, a translation table, which is included in a gateway in the private network, between the global address and the local address, and performs, from outside of the private network, predetermined control processing to communication of the computer in the private network using the specified local address.

Claims

1. A security system which performs predetermined control processing to a computer in a private network and is provided outside the private network, wherein the security system is configured to:

receive a global address which is a target of a threat from a threat detection system which detects the threat from an illegal attack server;

specify a local address corresponding to the received global address by referring to, based on the received global address, a translation table, which is included in a gateway in the private network, between the global address and the local address; and

perform, from outside of the private network, predetermined control processing to communication of the computer in the private network using the specified local address.

2. The security system according to claim 1, wherein

the security system is further configured to causes, by notifying the computer in the private network of performed control processing and date and time information, a log server to record the performed control processing.

3. A security system provided outside a private network, wherein the security system is configured to:

receive a global address which is a target of a threat and date and time information indicating when the threat is detected from a threat detection system which detects the threat from an illegal attack server; and

specify a local address corresponding to the global address at a time when the threat is detected by referring to, based on the received date and time information and the received global address, a log server which records a correspondence relation between a time stamp and information on translation between the global address and the local address in a gateway in the private network.

4. A security processing method in a computer network including a security system provided outside a private network, a threat detection system configured to detect a threat from an illegal attack server, and a gateway, which includes a translation table between a global address and a local address, in the private network, the security processing method comprising:

receiving, by the security system, a global address which is a target of the threat from the threat detection system which detects the threat from the illegal attack server;

specifying, by the security system, a local address corresponding to the global address by referring to, based on the received global address, a translation table of the gateway; and

performing, by the security system, predetermined control processing to communication of the computer in the private network using the specified local address.

5. A security processing method in a computer network including a security system provided outside a private network, a threat detection system configured to detect a threat from an illegal attack server, and a log server configured to record a correspondence relation between a time stamp and information on translation between a global address and a local address in a gateway configured to translate the global address and the local address in the private network, the security processing method comprising:

receiving, by the security system, a global address which is a target of the threat and date and time information indicating when the threat is detected from a threat detection system which detects the threat from the illegal attack server; and

specifying, by the security system, a local address corresponding to the global address at a time when the threat is detected by referring to the log server based on the received date and time information and the received global address.