JP2003256365A - Integrated management system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To reduce a burden of mastering each user interface, in a management operation such as setting change of multiple apparatus or mechanisms for providing security features, or browsing logs thereof, in a network system comprising multiple computers. <P>SOLUTION: An integrated management system is provided with the following arrangement. A program for editing contents of setting and program for displaying a log are arranged every apparatus group or mechanism group for providing security features in a management server for providing setting of an apparatus and mechanism and a user interface of log display. There is arranged a means for transmitting and receiving the setting contents data and log between the management server, and an apparatus and mechanism. There are arranged a program for installing the setting contents data created on the management server in each of the apparatus and mechanism, and a program for converting the log to be output by each apparatus and mechanism into the form that can be processed in the management server. <P>COPYRIGHT: (C)2003,JPO

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an integrated management system for managing a device group or a mechanism group that provides a security function for a network system composed of a plurality of electronic computers.

[0002]

2. Description of the Related Art Various devices and mechanisms that provide security functions, such as a virus checker and an intrusion detection tool, are provided for a network system composed of a plurality of electronic computers. Conventionally, each device or mechanism has provided a user interface for performing management work such as editing the setting items of these devices or mechanisms and viewing logs.

For example, CYBER SECURTY MANAGEMENT Feb.
2000 p.74 describes a system that centrally manages the settings of the virus checker installed in each client. Also, CYBER SECURTY MANAGEMENT Apr. 200
0 p.87 has a description of intrusion detection tools.

[0004]

In the above technique, the devices and mechanisms that provide the security function provide the user interface for performing the management work.
In order to manage the devices and mechanisms installed in the managed system, it was necessary for the administrator to become familiar with each user interface. In addition, it is often necessary to browse the logs output by each device or mechanism while switching the respective user interfaces.

As described above, the conventional technique has a problem in that the burden on the administrator is large in managing the security of the system to be managed.

[0006]

Therefore, in the present invention, by realizing an integrated management system with the following configuration,
It solves the above problem. -A management server that provides a user interface for setting devices and mechanisms and displaying logs is provided with a program that edits the settings and a program that displays logs for each device group or mechanism group that provides security functions. -Provides means for transmitting and receiving setting content data and logs between the management server and the devices and mechanisms. -The installation program for the setting content data created on the management server and the program for converting the log output by each device or mechanism into a format that can be processed by the management server are placed on each of the above devices and mechanisms. To do.

[0007]

BEST MODE FOR CARRYING OUT THE INVENTION One embodiment of the present invention is shown in FIGS.
Will be explained.

FIG. 1 is a diagram showing the overall configuration of the integrated management system of this embodiment. 101 is a network, 102
Is an integrated management server, and 103 to 105 are target servers. In this embodiment, not only a local network but also a wide area network such as the Internet can be used as 101.

FIG. 2 shows an integrated management server 102 and a setting target server which constitute the integrated management system of this embodiment.
It is a figure which shows the structure of 103.

In the internal configuration of the integrated management server 102, 201 is a CPU, 202 is a network communication interface, and 203 is an external storage device. External storage device 203
Includes a template group 2031 of setting content data prepared for each managed device or mechanism, a set content data file group 2032 of the managed device or mechanism actually used in the managed network, and a log file group 2033. Is stored. Reference numeral 204 denotes a memory, which is an operating system (OS) 2041, a management program 2042 that manages files related to this system stored in the external storage device 203 as programs that run on the operating system 2041, and a management target. Editing program group 2043 for editing the setting content data file 2032 prepared for each device or mechanism of
Log file 2033 for each managed device or mechanism
Log display program group that presents to the user
4 and the communication program 2045 used for communication with the managed server.

In the internal configuration of the setting target server 103, 205 is a CPU, 206 is a network communication interface, 207 is an external storage device, and external storage device 207
A setting content data file 2071 corresponding to the device or mechanism to be managed and a log file 2072 are stored in. Reference numeral 208 denotes a memory, which is an operating system (OS) 2081 and the above operating system 2081.
As programs running on the above, the managed device or mechanism 2082 and the managed device or mechanism 208
The installation program 2083 that installs the setting content data file 2032 in 2 and the log output by the above-mentioned managed device or mechanism 2082 are managed program 2
Log conversion program 2 that converts to a format that can be processed by 042
084 and the communication program 2085 used for communication with the integrated management server are placed.

FIG. 3 is a diagram showing an example of the setting content data template 2031 used by the integrated management system of this embodiment. The setting content data template 2031 is a set of setting items of the device or mechanism 2082 to be managed. For example, XML (extensible Markup Lan) such as 301 is set.
guage) format file. In this case, each setting item can be defined as an XML element, and the item name can be associated with the tag and the item value can be associated with the text node.
The XML element format corresponding to each setting item is shown below.

<Item name> value = "setting item value"</ item name
> The setting content data template 2031 is a template for creating the setting content data file 2032. If there is a default value as the setting item value, the setting item value is set to the default value as shown in 302. If not, enter a blank in the setting item value as shown in 303. In addition, if the pattern of possible setting item values has been decided, and you want to select from among them, 304
As shown in, describe the elements of the same tag multiple times. At this time, the element selected by default is "flg =" 1 "" after the setting item value, and "flg =" for other elements.
By adding "0"", the default value can be identified.

The XML format file 301 is an example of a template of setting content data for a firewall system, and is composed of a "rulebase" tag that defines information about access control rules and a "property" tag that defines information about properties. There is.

The "rulebase" tag includes elements with the following tags. -Source tag: define the source IP address-destination tag: define the destination IP address-service tag: define the service name of TCP / IP-action tag: the source and destination IP address and service Specifies the action to take when a match occurs. It is "accept" when accepting communication, and "deny" when rejecting it. ・ Logdata-type tag: Defines the data to be output as a log ・ install-point tag: Specifies the computer that executes this access control rule -Time tag: The "property" tag that specifies the valid time zone of this rule includes the elements by the following tags.・ Check-timing tag: Specify the timing to check the rules in the internal processing of the firewall ・ timeout tag: Specify the time of the connection timeout. In addition to this, information about the user who authenticates with the firewall is also expressed in XML format. However, it is also possible to retain it as a common format for various managed devices or mechanisms.

FIG. 4 is a diagram showing an example of the setting content data file 2032 used by the integrated management system of this embodiment. The setting content data file 2032 defines the setting item values of the setting content data template 2031 and can be defined using an XML format such as 401. In the setting contents data file 2032, 30
If the setting item does not have a default value as shown in 3, the value is rewritten to fill it. Also, in Figure 3, 304
If the pattern of possible values for the setting item is as shown in, and the setting item to be selected is
"Flg =" 1 "" for the selected element and "fg" for other elements.
By adding lg = "0"", it becomes possible to identify the selected value.

FIG. 5 is a diagram for explaining the flow of processing when setting data is installed in the device or mechanism 2082 to be managed by using the integrated management system of this embodiment. First, the integrated management system carries out the following series of operations on the integrated management server 102 according to a request from a network administrator who is a user. In 501, the management program 2042 is used by the user to manage the device or mechanism 2
The step of accepting the edit request for the setting information file 2032 of 082, 502 is the edit program 204 corresponding to the device or mechanism 2082 managed by the management program 2042.
Step 3 to start 3, 503 is the editing program 2043
However, the step of loading the setting information template 2031 of the managed device or mechanism 2082 from the external storage device 203, 504 the step of customizing the setting items of the managed device or mechanism 2082 by the user using the editing program 2043, 505 is the editing program 2043
Is a step for saving the setting content data file 2032 of the managed device or mechanism 2082, 506 is a step for the management program 2042 to start the communication program 2045 and establish a communication path with the setting target server 103, 507
The setting data file 2032 saved by the communication program 2045 in step 505 is set as the target server 103
Is the step of transferring to.

Further, in the integrated management system, each setting target server 103 starts the communication program 2085 which receives the communication request from the integrated management server 102 in advance, and then executes the following series of operations. 508 is a step in which the communication program 2085 receives a communication request from the integrated management server 102, and 509 is a communication program 2085.
Is the step of receiving the setting content data file 2032 of the managed device or mechanism 2082, and 510 is the step of the communication program 2085 starting the installation program 2083 and passing the received setting content data file 2032 to the installation program 2083. 511
The installation program 2083 executes the series of operations shown in FIG. 5, which is a step of rewriting the setting contents of the managed device or mechanism 2082, so that the integrated management system of this embodiment can be used to manage the managed device or mechanism. Can be set.

FIG. 6 is a diagram for explaining the flow of processing when referring to the log of the device or mechanism 2082 to be managed by using the integrated management system of this embodiment. First, the integrated management system carries out the following series of operations on the integrated management server 102 according to a request from a network administrator who is a user. 601 is a step in which the management program 2042 receives a display request for the log file 2033 of the device or mechanism 2082 to be managed from the user, and 602 is
The step in which the management program 2042 starts the communication program 2045 and establishes a communication path with the setting target server 103, 603, the management program 2042 is the communication program 2
A step of requesting the setting target server 103 to transmit a log via 045, and a step 604 of receiving the log data from the setting target server 103 and displaying the log data to the user using the log display program 2044.

In addition, in the integrated management system, each setting target server 103 starts the communication program 2085 that receives the communication request from the integrated management server 102 in advance, and then executes the following series of operations. 605 is a step in which the communication program 2085 receives a communication request from the integrated management server 102, and 606 is a communication program 2085.
Is a step of receiving a log transmission request to the managed device or mechanism 2082, 607 is a communication program
2085 is the requested managed device or mechanism 208
Step 2 to start the log conversion program 2084 corresponding to 2), 608 refers to the log file of the device or mechanism 2082 that is managed by the log conversion program 2084, converts it to a format that can be processed by the management program 2042, and converts it to the communication program 2085. A step of returning 609 is a step of returning the log data converted by the communication program 2085 to the integrated management server 102.

Here, the editing program 2043 is a program that assists the user in the work of customizing the setting values of the setting items described in the setting content data template 2031. Editing program 2043 of the present embodiment
Displays the edit screen in which the setting items and their default setting values are preset using the contents of the setting content data template 2031. Especially when the settings data template 2031 uses XML format,
The layout of the displayed screen is XSL (eXtensible Style
sheet language) to convert to HTML format
You can also build an edit screen on the browser.

FIG. 7 is a diagram for explaining a method of configuring the editing program 2043 realized by using such Web technology. 701 is a web browser, 702 is a web server, 7
03 is a group of CGI programs started by the Web server 702, and 704 is an XSL file that creates a screen layout. Here, 702 to 704 are the integrated management server 102
It is the one arranged above. The 601 may be placed on the integrated management server 102 or on a client computer that can communicate with the integrated management server by TCP / IP.

When the URL of the XML-format setting content data template 2031 is specified in the Web browser 701, the Web server 702 displays the setting content data template
Send 2031 and XSL file 704 to the browser.
The Web browser 701 interprets the setting contents data template 2031 according to the contents of the XSL file 704 and generates and displays the form screen for editing the setting items. The above form screen shows CGI included in CGI program group 703.
Items for starting the program are arranged. The user selects C by selecting the above item.
Various CGI programs included in the GI program group 703 can be started.

Here, various CGI programs include a program for transferring a local file to the integrated management server 102, a program for outputting the parameters of the setting items edited on the form to the setting information file 2032, and
There is a program that calls the communication program 2045 and transfers the setting contents data file 2032 to the managed server 103. The log display program 2044 can also be configured by the same method as the editing program 2043.

FIG. 8 shows the setting content data template 203
FIG. 9 is a diagram showing an example of a screen used by the editing program 2043 corresponding to the XML format file 301 as 1.

Reference numeral 801 is a list describing access control rules, 802 is a button for adding an access control rule entry, and 803 is a button for deleting an access control rule entry. When the add button 802 is pressed, the CGI program 703 that adds one entry of the access control rule is started. Also, a check button is attached to the 801. If the delete button 803 is clicked while it is checked, the entry is deleted CG
I Program 703 is started.

804 and 805 are areas for setting properties, and 804 is an inspection timing property,
805 sets timeout properties respectively. Like the inspection timing property, the pattern of possible values for the setting item is fixed, and when selecting from among them, it is displayed as a selection list like 804. Also, if the default value is set, such as timeout, the default value is displayed in advance, such as 805.

Reference numeral 806 denotes a button used after the customization of each field is completed. By pressing this button, a CGI for generating the setting content data file 2032
Program 703 is started. A program for browsing the log can also be realized with the same configuration as the above-mentioned editing program.

[0029]

As described above, according to the present invention, a similar user interface can be used when a network administrator uses a device or mechanism that provides various security functions to perform management work, and the burden is reduced. be able to.

[Brief description of drawings]

FIG. 1 is a diagram showing an overall configuration of an integrated management system of the present embodiment.

FIG. 2 is a diagram showing a configuration of an integrated management server and a setting target server which configure the integrated management system of the present embodiment.

FIG. 3 is a diagram illustrating a setting content data template according to the present embodiment.

FIG. 4 is a diagram illustrating a setting content data file according to the present embodiment.

FIG. 5 is a diagram exemplifying a customization process of setting information according to the present embodiment.

FIG. 6 is a diagram exemplifying a display process of log information according to the present embodiment.

FIG. 7 is a diagram exemplifying a method for configuring an editing program according to the present embodiment.

FIG. 8 is a diagram exemplifying a screen of an editing program according to the present embodiment.

[Explanation of symbols]

102. .. Master Management Server, 103 .. .Setting target server,
201, 205 .. CPU, 202, 206 .. Network communication interface, 203, 207 .. External storage device, 2031.
.. Setting content data template group, 2032. .. Setting content data file group, 204, 208 .. Memory, 2041,
2081 ... Operating system (OS), 2042 ...
Management program, 2043 ... Editing program group, 2044.
.. Log display program group, 2045, 2085 .. Communication program, 2071 .. Setting data file, 2082 ..
Device or mechanism to be managed, 2083. Installation program, 2084. Log conversion program.

   ─────────────────────────────────────────────────── ─── Continued front page    (72) Inventor Hiromi Isogawa             1099 Ozenji, Aso-ku, Kawasaki City, Kanagawa Prefecture             Ceremony company Hitachi Systems Development Laboratory (72) Inventor Toru Senoo             5030 Totsuka Town, Totsuka Ward, Yokohama City, Kanagawa Prefecture             Ceremony Company Hitachi Ltd. Software Division F term (reference) 5B042 GA12 GB02 MC40 NN31                 5B076 AA03 AA04 DF08 FD08                 5B085 BE07 CE00                 5B089 GB02 KA17 KB13

Claims (7)

[Claims] 1. An integrated management system comprising, in a network system composed of a plurality of electronic computers, a device group or a mechanism group that provides a security function, and a management server that manages the device group or the mechanism group. The management server includes means for providing a user interface for setting and log display of the device group or mechanism group, a program for editing the setting contents for each of the device group or mechanism group, and a program for displaying a log,
Integrated management characterized in that each device or mechanism is provided with a program for installing the setting contents in the device or mechanism and a program for converting a log output by the device or mechanism into a format processed by a management server. system. 2. The integrated management system according to claim 1, wherein the setting content editing program on the management server is used to edit the setting content of the device or mechanism, and the setting created by the processing. And a means for performing a process of transferring the content to the device or the mechanism, and a means for performing a process of installing the setting content in the device or the mechanism by using an installation program operating on the device or the mechanism. Integrated management system to do. 3. The integrated management system according to claim 1, wherein a log format conversion program that operates on a device or mechanism is used to convert a log output by the device or mechanism into a format that can be processed by a management server. Means for performing the above, a means for performing processing for transferring the log created by the above processing to the management server using the communication means between the management server and each device or each mechanism, and a log display program on the management server An integrated management system comprising: means for performing a process of presenting a log to a user by using. 4. The integrated management system according to claim 1, comprising an integrated management server connected to a network, and an agent program arranged on a plurality of setting target servers. 5. The integrated management system according to claim 1, wherein an XML format is used as a file format for describing the setting information. 6. The integrated management system according to claim 2, wherein the editing screen of the editing program is displayed on a computer different from the management computer, and remote editing work is enabled. Management system. 7. The integrated management system according to claim 3, wherein the editing screen of the editing program is displayed on a computer different from the management computer, and the log browsing work can be performed remotely. Integrated management system.