JP2003108255A - Group management fire wall system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To realize a function that simultaneously protects a plurality of servers from an illegal invader from outside an organization such as a hacker and save a time-consuming job required for management of the servers by realizing the aforementioned. SOLUTION: Data and programs that becomes an attacked target of a hacker are not permanently stationed on a memory means by object-orienting the data and programs, and a function that dynamically renew an object by externally controlling the object is realized. The servers in a group mutually reflect an attack coping means against a hacker to all servers forming the group by grouping the servers using a dynamically renewing function.

Description

Detailed Description of the Invention

[0001]

The present invention can be used for a computer group and a plurality of in-house networks connected by LAN and an intranet, which are in-house networks connected to the Internet.

[0002]

2. Description of the Related Art A firewall is a fire protection installed between the internal connection system, that is, between a router or access server and an in-house system (intranet) to protect the in-house system against unauthorized access from the outside. It is a wall.

FIG. 1 is a schematic diagram of a basic firewall. First, the part that connects to the outside, including the firewall, is called a barrier segment. Next, prepare a demilitarized zone (DMZ: demilitarized zone) that blocks attacks from the outside by a firewall, in which a public web server, mail server, DN
An S server and the like will be installed to further enhance these security levels.

Conventionally, firewall technology has been established as one of the countermeasures for protecting a computer connected to an internal network and data held on the computer from an unauthorized intruder from outside the organization. This was to detect and block unauthorized access by monitoring data packets moving on the boundary with the outside of the organization such as the Internet. As a result, the internal data of the organization can be maintained and the security can be secured.

[0005]

In the past firewalls, it was necessary to install firewall package software for each in-house network. Also, the administrator has taken the form of setting and updating for each in-house network.

Therefore, in order to protect a plurality of in-house networks from unauthorized intruders from outside the organization, firewall package software and an administrator for the number of in-house networks are required and the same security level is realized. In order to do so, there is a problem that the quality of the manager is questioned.

[0007]

[Means for Solving the Problems] "Same as claims"

[0008]

BEST MODE FOR CARRYING OUT THE INVENTION First, a software secure system shown in claim 1 is required in the system of the present application. If this software secure system is installed on a server that serves as an entry route for unauthorized intruders from outside the organization such as hackers to enter the computer network within the organization, important data and programs should be stored in memory. Therefore, it is possible to build an environment that does not reside in the storage device of the computer.

Furthermore, by using the dynamic object update system according to the second aspect, it is possible to update dynamically without stopping the software secure system.

Since the dynamic object update system is software, it is not necessary to scan hardware switches or the like to perform dynamic update. Therefore, it is possible to dynamically update the software from a remote place.

Therefore, a server group is constructed using the dynamic object update system, and one server constituting the server group is attacked by an unauthorized intruder from outside the organization such as a hacker, and a patch as a countermeasure program is completed. By doing so, the patch is distributed to all the servers forming the server group and dynamically updated, thereby constructing a group management firewall system that protects the entire server group.

[0012]

EXAMPLES Next, optimum examples of the present application will be described. FIG. 2 is a schematic configuration diagram of the group management firewall system of the present application, which will be described below with reference to FIG. The software secure system 11 converts the data program 2 to be protected from an unauthorized intruder from outside the organization such as a hacker into a software object 112 by using the object generating means 111. As a result, important data and programs can be expanded in the memory, so that it is possible to construct an environment that does not reside in the storage device of the computer. The environment that is not resident in the storage device of the computer means that the data program 2 targeted by an unauthorized intruder from outside the organization such as a hacker does not exist.
It is very effective against the hacker attack of Program 2. The data program 2 converted into the software object 112 using the object generation means 111 uses the software construction means 113,
Since it can be returned to the original software, it may be generated when the data program 2 has to be used. Furthermore, in the present invention, the software object 1
By using the dynamic object update system 12 for 12, it is possible to dynamically change the running state without stopping the software secure system 11. This can be implemented by the process management means 121 and the memory management means 122 always managing the process and the memory for each unit time of the processing execution of the computer. As a result, the software secure system 11 becomes a system that can cope with attacks from unauthorized intruders from outside the organization such as new hackers.
It is possible to update while the program is running. Furthermore, this dynamic object update system 12
If the object receiving means 14 for receiving the update control signal from the outside and the object to be updated is applied to the dynamic object update system 12, the dynamic object update system 12 is software. Since it is not necessary to scan switches and the like, it is possible to dynamically update the software from a remote location. By using this function, the software secure system 11 on the server can be updated via the computer network, so that the trouble of the server administrator can be drastically reduced, and the dynamic firewall update which also reduces the maintenance fee of the server. The system 1 can be constructed. In addition, if this function is used, in a computer network environment where new hackers are constantly being created, if an institution that monitors, discovers, and responds to attacks from that hacker is created, then that institution will find out what to do Will be able to patch all servers involved in. If the servers constructed using the dynamic firewall update system 1 are group-managed, one server forming the group is exposed to an attack from an unauthorized intruder from outside the organization such as a hacker, Once the patch, which is a countermeasure program, is completed, the patch can be instantly reflected on all the servers that make up the server group, and the countermeasure can be taken before attacks from unauthorized intruders from outside the organization such as hackers. Therefore, there is a possibility that further security improvement can be expected.

[0013]

When the group management firewall system of the present invention is adopted, important data and programs are not made to reside in the storage means of the computer by the software secure system, and thus unauthorized intrusion from outside the organization such as hackers. Since the attack target itself from the attacker disappears, it is extremely unlikely that the server will be hit by the attack. Furthermore, if you build a firewall using the dynamic object update system function, you can easily update from a remote location. So far, at least the number of server installation locations required for server administrators was reduced. It is possible to reduce. Furthermore, by using a group management firewall system, if one of the server groups is attacked and a patch is taken to deal with it, the patch will be instantly reflected on all the servers that make up the server group. It is possible to protect the entire group from unauthorized intruders from outside the organization such as hackers, which is an excellent effect.

[Brief description of drawings]

FIG. 1 is a schematic configuration diagram of a conventional firewall system.

FIG. 2 is a schematic configuration diagram of a group management firewall system of the present application.

[Explanation of symbols]

─────────────────────────────────────────────────── ─── Continuation of front page (51) Int.Cl. ⁷ Identification code FI theme code (reference) G06F 15/00 330 G06F 9/06 660L (72) Inventor Kazuhiko Tsuda 3-29-1 Otsuka, Bunkyo-ku, Tokyo Issue University of Tsukuba F-term (Reference) 5B017 AA07 BB09 CA01 CA15 5B076 AC03 AC09 BA04 BB02 BB06 FD04 FD08 5B082 EA11 HA01 HA08 5B085 AE00 BG07 5B089 GA11 GB02 GB10 KA17 KB04 KB09 KB13 KC13

Claims (4)

[Claims] 1. A computer in a network and data held on the computer are illegally sent from outside the organization such as a hacker to a computer group connected to a LAN, an intranet or the like which is an in-house network connected to the Internet. An object generating means for converting software such as data and programs into software objects and a software constructing means for reconstructing software such as data and programs from software objects generated by the object generating means for the purpose of protecting from intruders. By creating software from an object when a data transmission request is made, an environment where hackers and other illegal intruders from outside the organization falsify the data to be stored in storage means is not created. A software secure system that, when built, protects your computer and the data held on it. 2. The software secure system according to claim 1, wherein a memory management unit that manages a memory space managed by a program being executed, and a process of managing a process of the program being executed every one unit time. A dynamic object update system characterized in that it has a management means, thereby making it possible to update a software object that constitutes a program being executed, and dynamically updating it without stopping the program. 3. The dynamic program according to claim 2, wherein a firewall program is constructed for the purpose of protecting a server connected to an external network in a computer network from an unauthorized intruder from outside the organization such as a hacker. Constructed using the object update system, and the dynamic object update system is provided with the object receiving means for receiving and reflecting the program object distributed from the remote, thereby updating the firewall program remotely without stopping the firewall program. A dynamic firewall update system characterized by what it can do. 4. A server connected to an external network in a computer network, wherein a firewall program for the server is constructed by using the dynamic firewall update system according to claim 3, and a plurality of dynamic firewall update systems are required. When a patch that is a program that counters the broken mechanism is developed when one of the servers that configures the server group and the server group that configures the server group is broken, and that patch is distributed to the server group A group firewall system that improves the function as a firewall by reflecting the patch on all the servers that make up the server group by using distribution means.