(12) United States Patent (10) Patent N0.: US 8,626,915 B2 Uchida (45) Date of Patent: Jan
Total Page:16
File Type:pdf, Size:1020Kb
US008626915B2 (12) United States Patent (10) Patent N0.: US 8,626,915 B2 Uchida (45) Date of Patent: Jan. 7, 2014 (54) ROUTING METHOD 2006/0059279 A1* 3/2006 KakiZaki ....................... .. 710/33 2007/0162749 A1 7/2007 Lim (75) Inventor: Yoshiaki Uchida, Kawasaki (JP) 2007/0174501 A1 * 7/2007 Lln et a1‘ """""""""""" " 710/15 (73) Assignee: Fujitsu Limited, Kawasaki (JP) FOREIGN PATENT DOCUMENTS ( * ) Notice: patentSubject' is to extendedany disclaimer, or adjusted the term under of this 35 JP 2002-312316 :2 10/2002 U.S.C. 15405) by 0 days. JP 2003-122615 4/2003 JP 2004-185312 7/2004 (21) Appl' NO". 12/766’017 JP 2006-0854012005-130214 3/20065/2005 . JP 3994126 10/2007 WO 00/22796 4/2000 (65) Prior Publication Data WO 2004/ 100456 A1 11/2004 Us 2010/0205300 A1 Aug. 12, 2010 OTHER PUBLICATIONS _ _ International Search Report for PCT/ J P2007/ 070796, mailed on Mar. Related US. Application Data 18, 2008' (63) Continuation of application No. PCT/JP2007/070796, Chinese Of?ce APP?“ issued Aug 24, 2012 in Corresponding Chi ?led on Oct 25 2007 nese Patent Application No. 2007801012733. ' ’ ' Chinese Of?ce Action mailed Mar. 7, 2013 for corresponding Chi (51) Int Cl nese Application No. 2007801012733. ' ' Extended European Search Report dated Feb. 17, 2012 issued in G06F 15/1 73 (200601) corresponding European Patent Application No. 078305307. (52) U-s- Cl- Chinese Of?ce Action issued May 15, 2012 issued in corresponding USPC ......................................... .. 709/225; 709/224 Chinese Patent Application No. 2007801012733. (58) Field of Classi?cation Search _ _ USPC ................ .. 709/216, 224, 225, 229, 370/389; * med by examlner 707/100; 710/15 Primary Examiner * Quang N Nguyen See application ?le for complete search history. (74) Attorney, Agent, or Firm * Staas & Halsey LLP (56) References Cited (57) ABSTRACT U.S. PATENT DOCUMENTS A method executed by a router that establishes a connection between a network and an another network that includes an 6,535,227 B1 * 3/2003 Fox et al. .................... .. 709/224 information processing device and an information storage 6,742,040 B1 * 5/2004 Toga .......... .. 709/229 device, the method includes: detecting an access status of the 7,143,096 B2 * 11/2006 Gemba et al. 709/216 information processing device to the information storage 8,010,627 B1 * 8/2011 Schneebeli et a1 709/229 2002/0107961 A1* 8/2002 Kinoshita ................... .. 709/225 device; and prohibiting transfer of the information from the 2004/0022242 A1* 2/2004 Bhogal et a1. ............... .. 370/389 information processing device to the another network 2004/0111603 A1 6/2004 Iwamura depending on the access status managed in the detecting. 2005/0108257 A1* 5/2005 Ishii et al. ................... .. 707/100 2005/0229245 A1 10/2005 Nakano et al. 7 Claims, 15 Drawing Sheets 500 ROUTER ~503 EXTERNALCONTROL ACCESS UNIT L, 506 EXTERNAL NETWORK 8 505 PC PC FILEACCESS MONITORING UNIT 507 SYSTEM CONTROL UNIT 508 CHARACTERISTIC PATTERN GENERATING UNIT 509 CI-IARACTERISTIC PATTERN 510 DICTIONARY FILE SEARCH UNIT 511 ADDING FUNCTION 512 US. Patent Jan. 7, 2014 Sheet 2 0f 15 US 8,626,915 B2 6x500:2: momm2 N .wN_u_ momSN wwmoo<l_<zmm_bm_0QHw:UmmA|v “E90;N Ego; QwHTmQIQEHQEI Q5280$29280 4 ‘7 wm?nom US. Patent Jan. 7, 2014 Sheet 3 0f 15 US 8,626,915 B2 zoo,6205,,33E, .EMwwmmagogzwwmmamfb 0Q2956936932wmmwgmg o25mmNwonomnowomnomémmmwgm? 2Q290omonomnowomnomngwwwwgm? .QEm Sm8mmomomNew amA 8N US. Patent Jan. 7, 2014 Sheet 4 0f 15 US 8,626,915 B2 ~ mow ZOEUZE 20:.023;6045.46/\ wziotzoz55E5‘3 on_ on_ US. Patent Jan. 7, 2014 Sheet 6 6f 15 US 8,626,915 B2 OE@ US. Patent Jan. 7, 2014 Sheet 7 0f 15 US 8,626,915 B2 N 5 E 852528R2 6x58:232 8|Néogmzézmmbm :NKENE2252 an@E N EmmiZQBEOZQ6x58555v55ézmmbm v55255m< GEN @zEmEQ:75 @Em? N $5528ézowmmi 4 $82ME 959202:75 US. Patent Jan. 7, 2014 Sheet 8 0f 15 US 8,626,915 B2 éogmzézmmcm| ~ Now 6x58:2:8w gmE2252 8%?528w2 6x58£52555v5555% <V55255m :75 8m N ~ <mow £82ME @5920;:23 US. Patent Jan. 7, 2014 Sheet 9 0f 15 US 8,626,915 B2 80ml_2:$82Q55HE gag 8%“L865Q52 mzOmw<mmoz_>m5mm: mm._EH momw a3% _ZOEEEQ75o ZOEEEO562:E55 V US. Patent Jan. 7, 2014 Sheet 10 0f 15 US 8,626,915 B2 89w?mzOmosamm>m@215 @005Qzm > US. Patent Jan. 7, 2014 Sheet 13 0f 15 US 8,626,915 B2 mom? ~ N E225hv moéokmE052:75I #2 N 4‘ N N> 5252 3%vE225v k 82 US. Patent Jan. 7, 2014 Sheet 14 0f 15 US 8,626,915 B2 mo? N [\\ ) $52ME( 6x58 :75 6x5855%( :75 on_ on_ US 8,626,915 B2 1 2 ROUTING METHOD FIG. 3 is a Bad PC List 203 according to the embodiment. FIG. 4 is a con?guration diagram of a network storage CROSS-REFERENCE TO RELATED system 400 according to the embodiment. APPLICATION FIG. 5 is a con?guration diagram of a network storage system 500 according to the embodiment. This is a continuation of Application PCT/J P2007/ 070796, FIG. 6 is a con?guration diagram of a network storage ?led on Oct. 25, 2007, the entire contents of which are incor system 600 according to the embodiment. porated herein by reference. FIG. 7 is a con?guration diagram of a network storage system 700 according to the embodiment. FIELD FIG. 8 is a con?guration diagram of a network storage system 800 according to the embodiment. A certain aspect of the embodiments discussed herein FIG. 9 is a ?owchart related to open operation of the NAS relates to technique of a network storage, such as an NAS according to the embodiment. (network attached storage). FIG. 10 is a ?owchart related to close operation of the NAS 104 according to the embodiment. BACKGROUND FIG. 11 is a ?owchart of counting operation executed by the router 103 according to the embodiment. A network storage, such as an NAS, has been increasingly FIG. 12 is a ?owchart of packet transfer operation executed used. Constant connection to the Internet in a computer has by the router 103 according to the embodiment. become common. Therefore, even when users access ?les in 20 FIG. 13 is a hardware block diagram of the NAS 104 an NAS in a situation that most computers are placed in a according to the embodiment. closed area, such as a LAN, the computers are connected to FIG. 14 is a con?guration diagram of the network storage the Internet. system 100 according to the embodiment. This causes a problem that malicious software (hereinafter, FIG. 15 is a con?guration diagram of the network storage referred to as malware) opens data, stored in the NAS, to the 25 system 100 according to the embodiment. public on the Internet in a form that is not intended by a user. In addition, there may also be a problem due to a careless, DESCRIPTION OF EMBODIMENTS inappropriate operation, such as a case where a user misiden ti?es an actually public area on the Internet as a private work A network storage system according to an embodiment is a area and then places important private data therein or a case 30 system in which a plurality of personal computers and an where a user establishes connection to a network while a NAS are connected by a LAN (Local Area Network) and then folder that originally should not be open to the public remains a network outside the LAN and the personal computers are open to the public. connected via a router. Then, the personal computers access There is a simple solution for the above problems, that is, to ?les via the LAN or access the Internet via the router. The “directly unplug a LAN cable”; however, this requires 35 NAS according to the present embodiment executes control unplugging a LAN cable of a router, or the like, so it is so that data stored in the NAS do not leak onto the Internet burdensome. against user’s intention. There is the following Patent Document related to a tech A particularly problematic case where data stored in the nique for preventing information leakage in a computer. NAS leak onto the Internet is caused by malware. [Patent Document 1] Japanese Laid-open Patent Publica 40 A route through which data on the Internet leak owing to tion No. 2003-122615 malware against user’s intention is conceivably the following cases. iMalware sets a secret folder to a public folder of a SUMMARY ?le sharing folder. iMalware copies a secret ?le into a public folder. iMalware transfers a secret ?le by mail at user’s According to an aspect of an embodiment, a method unintended timing. executed by a router that establishes a connection between a Existing measures for these problems are as follows. iA network and an another network that includes an information personal computer detects “malware” by antivirus software. processing device and an information storage device, the iA personal computer shuts off an external network connec method includes: detecting an access status of the informa tion to the personal computer by a software ?rewall. iA tion processing device to the information storage device; and 50 personal computer monitors leakage of important data by a prohibiting transfer of the information from the information physical ?rewall. processing device to the another network depending on the However, according to the measures of the above described access status managed in the detecting. 1, an action against a new type of virus delays. The above The object and advantages of the invention will be realiZed measures are ineffective for a personal computer that is ini and attained by means of the elements and combinations 55 tially or early infected with “malicious software”.