JP2006184936A - Information system setting device, information system setting method and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To enable system setting which complies with an information security policy to be dynamically executed matching with the environment of a user including the type of a client terminal. <P>SOLUTION: A policy determination processing part 163 determines policy information necessary for setting an information system from access information from a client terminal or user attribute information acquired from information managed by a user management device acquired by a user information acquisition processing part 161 or client property information acquired from information transmitted from the client terminal or information managed by the user management device acquired by a client property information acquisition processing part 160 or the contents of processing to be executed by the information system. A system setting preparation processing part 152 prepares equipment setting information showing the setting contents of each equipment configuring the information system from the information provided from each configuration of the policy determination processing part 151. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to an information system setting device for setting an information system according to an information security policy.

Various techniques have been proposed that enable management of the security status in an information system without requiring special expertise. For example, by electronically describing a security policy for a document in accordance with a predetermined description format, a consistent security policy can be shared throughout the information system, and for example, any user type depending on the document type (category, level) (Category, Level) proposes a system that can clearly describe what operations can be performed on a document and what requirements must be met if operations are possible (For example, Patent Document 1).
JP 2004-102907 A

In addition, an access control policy can be set automatically by creating an access control policy using information acquired when performing access control and determining the legitimacy of file access requests based on the access control policy. An access control system that can be constructed without special knowledge is proposed (for example, Patent Document 2).
JP 2003-6027 A

In addition, multiple management units that control the security status of the managed system to match the information security policy and audit units that audit the security status related to the information security policy of the managed system are prepared and extracted. Change the security status of the managed system corresponding to the managed department to match the corresponding information security policy, or audit the security status related to the information security policy of the managed system corresponding to the extracted audit department A system has been proposed (for example, Patent Document 3).
Japanese Patent Laid-Open No. 2002-247033

In addition, a plurality of security policies are stored, and a security policy is selected according to the operating environment or situation of the mobile device, such as whether or not an information processing device such as a mobile device is connected to the LAN. A system for determining the safety of an apparatus has been proposed (for example, Patent Document 4).
JP 2004-265286 A

  The technique described in Patent Document 1 is for ensuring the safety in the operation for the document, and the technique described in Patent Document 2 is for ensuring the safety in file access. In the technique described in Patent Document 3, only the security management program extracted for the information security policy selected by the operator is activated. As described above, in the technologies described in Patent Documents 1 to 3, the targets to which a security policy can be set are limited, and the system setting is flexibly performed according to the security policy corresponding to the type and environment of the client terminal that makes an access request. There were problems such as being difficult.

  In the technique described in Patent Document 4, the security policy is selected according to the environment in which the information processing apparatus is placed (for example, whether the connection is in the office LAN or the connection in the network outside the office). However, the system setting cannot be performed according to the security policy corresponding to the type of information processing terminal (for example, whether it is a notebook personal computer, a PDA, or a mobile phone).

  As information processing technology advances, information processing apparatuses serving as client terminals that can access information systems are diversifying. Even if the user accessing the information system is the same, if the information processing apparatus serving as the client terminal is different, the safety of information management will be different. For this reason, there is an increasing need to perform flexible system settings in accordance with a security policy corresponding to an information processing apparatus serving as a client terminal. In addition, it is desired to set accessible information resources so that they can be changed according to user attributes such as departments and positions of users who access the information system.

  The present invention has been made in view of the above circumstances, and information security policy management capable of dynamically performing system settings according to the information security policy in accordance with the user environment including the type of client terminal. The purpose is to provide a system.

In order to achieve the above object, an information system setting device according to the first aspect of the present invention provides:
An information system setting device for setting an information system according to an information security policy,
A policy management database that stores policy information describing information security policies;
Attribute information acquisition means for acquiring user attribute information;
Terminal property information acquisition means for acquiring property information of a terminal device that has transmitted an access request to the information system;
System property information acquisition means for acquiring property information of each device constituting the information system;
Policy information reading means for reading out the policy information stored in the policy management database based on the attribute information acquired by the attribute information acquisition means and the property information of the terminal device acquired by the terminal property information acquisition means;
The information system is set by creating setting information of the information system based on at least the policy information read by the policy information reading means and the system property information acquired by the system property information acquisition means. Comprising setting control means,
It is characterized by that.

According to this configuration, the policy information reading unit is configured to retrieve the policy information stored in the policy management database based on the attribute information acquired by the attribute information acquisition unit and the property information of the terminal device acquired by the terminal property information acquisition unit. read out. The setting control means can set the information system based on the policy information read by the policy information reading means and the system property information acquired by the system property information acquisition means.
This makes it possible to set the information system according to the information security policy corresponding to the property information of the terminal device that sent the access request to the information system and the attribute information of the user, and depending on the environment including the type of the terminal device The information system can be flexibly set according to the information security policy.

  The policy management database includes main policy information describing an information security policy independent of the configuration of the information system, and a sub-policy describing conditions or operation rules related to settings of the information system that are referred to by the main policy information Information may be stored as the policy information.

The policy information reading means comprises the related information acquisition means for analyzing the policy information read from the policy management database and acquiring the related information of the policy information,
It is desirable that the setting control unit sets the information system based on the related information acquired by the related information acquisition unit.

  The policy information reading means may include means for determining policy information to be read from the policy management database based on the property information of the terminal device acquired by the terminal property information acquisition means.

In order to achieve the above object, an information system setting method according to a second aspect of the present invention includes:
An information system setting method by a computer for setting an information system according to an information security policy,
A policy information storage step for storing policy information describing an information security policy in a policy management database;
An attribute information acquisition step for acquiring user attribute information;
A terminal property information acquisition step of acquiring property information of a terminal device that has transmitted an access request to the information system;
A system property information acquisition step of acquiring property information of each device constituting the information system;
A policy information reading step for reading out the policy information stored in the policy management database based on the attribute information acquired in the attribute information acquisition step and the property information of the terminal device acquired in the terminal property information acquisition step;
The information system is set by creating setting information of the information system based on at least the policy information read in the policy information reading step and the system property information acquired in the system property information acquisition step. A setting control step,
It is characterized by that.

Analyzing the policy information read in the policy information reading step, and providing a related information acquisition step of acquiring related information of the policy information;
The setting control step preferably sets the information system based on the related information acquired in the related information acquisition step.

In order to achieve the above object, a program according to the third aspect of the present invention provides:
On the computer that sets up the information system according to the information security policy,
Policy information storage processing for storing policy information describing an information security policy in a policy management database;
Attribute information acquisition processing for acquiring user attribute information;
Terminal property information acquisition processing for acquiring property information of a terminal device that has transmitted an access request to the information system;
System property information acquisition processing for acquiring property information of each device constituting the information system;
A policy information reading process for reading out the policy information stored in the policy management database based on the attribute information acquired in the attribute information acquisition process and the property information of the terminal device acquired in the terminal property information acquisition process;
The information system is set by creating setting information of the information system based on at least the policy information read by the policy information reading process and the system property information acquired by the system property information acquisition process. Setting control processing;
Is executed.

In addition, the computer
Analyzing the policy information read in the policy information reading process, further executing a related information acquisition process for acquiring related information of the policy information,
In the setting control process, it is preferable to set the information system based on the related information acquired in the related information acquisition process.

  According to the present invention, the system setting according to the information security policy can be flexibly performed according to the environment of the user including the type of the terminal device that has transmitted the access request to the information system.

  The policy management apparatus 100 according to the embodiment of the present invention will be described below. FIG. 1 shows a configuration example of an information system 10 to which the policy management apparatus 100 is applied. An information system 10 illustrated in FIG. 1 is operated as an in-house system, for example, and is connected to the external network 11 and receives an access request from the client terminal 50. The external network 11 may be a general telecommunication network such as the Internet, a mobile communication network, and a public line network.

  The client terminal 50 is an information processing apparatus capable of executing software programs for processing various types of information, such as a desktop personal computer, a notebook personal computer, a PDA (Personal Digital Assistants), a mobile phone, and the like. The information system 10 is accessed via the external network 11 or connected to the switch 120 included in the information system 10. That is, the client terminal 10 may be external to the information system 10 or may be internal to the information system 10.

  The information system 10 operated as an in-house system includes a business system 15, a firewall 111, a switch 120, and a quarantine system 300. These devices constituting the information system 10 can be connected to each other via a network using, for example, a LAN cable or wireless communication. The information system 10 may be a virtual internal network system constructed using VPN (Virtual Private Network). In addition, the information system 10 may include various network devices and information processing devices such as routers, bridges, repeaters, hubs, network storages, faxes, printers, scanners, multifunction devices, or digital home appliances.

  The business system 15 includes a policy management apparatus 100, a user management apparatus 101, an administrator terminal 102, and a plurality of servers 110-1 to 110-N.

  The policy management device 100 has a function as an information system setting device for setting the information system 10 according to the information security policy. The policy management apparatus 100 includes, for example, an external storage device such as a CPU, a memory, and a hard disk device, a communication device connected to the internal network of the information system 10, an input device such as a keyboard and a mouse, a display device such as a display, a magnetic disk and an optical disk It can be constructed on a hardware configuration in an electronic computer such as a general workstation provided with a reading device that reads data from a storage medium such as the above. In this policy management apparatus 100, for example, the CPU executes a predetermined program read from a predetermined storage device (for example, a hard disk device), or stores a file having a predetermined data structure in the predetermined storage device. A configuration as shown in FIG. 2 is realized. As illustrated in FIG. 2, the policy management apparatus 100 includes a policy registration processing unit 150, a policy determination processing unit 151, a system setting creation processing unit 152, a policy management database 153, and a system information database 154. .

  The policy registration processing unit 150 registers an information security policy based on information acquired from the administrator terminal 102. For example, the policy registration processing unit 150 acquires policy information in which an information security policy is described in a predetermined policy description language by communicating with the administrator terminal 102, and stores the acquired policy information in the policy management database 153. Store. Further, the policy registration processing unit 150 creates policy information that describes the information security policy based on information acquired by communication with the administrator terminal 102 or information acquired by access control in the internal network of the information system 10. The created policy information may be stored in the policy management database 153.

  The policy determination processing unit 151 determines an information security policy to be applied to the information system 10 in response to an access request from the client terminal 50 or a request from the administrator terminal 102, and performs system setting by the system setting creation processing unit 152. Execute processing to acquire various necessary information. For example, the policy determination processing unit 151 includes a client property information acquisition processing unit 160, a user information acquisition processing unit 161, a system property information acquisition processing unit 162, a policy determination processing unit 163, and a policy information determination processing unit 164. It has.

  The client property information acquisition processing unit 160 acquires, from the client terminal 50 or the like, client property information that can specify the characteristics of the client terminal 50 that has transmitted an access request to the information system 10. For example, when there is an access request from the client terminal 50, the client property information acquisition processing unit 160 acquires the terminal identification information, environment identification information, software installation information, and the like of the client terminal 50 as client property information. Here, specific examples of the terminal identification information may be an IP (Internet Protocol) address, a MAC (Media Access Control) address of the client terminal 50, a terminal ID of the mobile phone, or the like. Further, a specific example of the environment identification information may be a network address of the access point 20 or the like. Specific examples of software installation information include, for example, the name and version of an OS (Operating System) installed in the client terminal 50, the name and version of an application program, the name and version of virus detection software, the version of a virus definition file, Any information that can specify the update date and time may be used.

  Note that the client property information acquisition processing unit 160 may acquire all of the terminal identification information, environment identification information, and software installation information of the client terminal 50 from the client terminal 50, or may acquire only a part from the client terminal 50. Other information may be acquired from information managed by the user management apparatus 101. Further, every time an access request is received from the client terminal 50, the client property information acquisition processing unit 160 needs to acquire all of terminal identification information, environment identification information, software installation information, and the like, which are client property information, from the client terminal 50. Instead, for example, a part of the information may be held in the user management apparatus 101 so that only necessary information may be acquired from the client terminal 50. Further, the client property information acquisition processing unit 160 determines, for example, whether the client terminal 50 is a desktop personal computer, a notebook personal computer, a PDA, or a mobile phone from the data format of the access request sent from the client terminal 50. The terminal identification information may be created by specifying the type of the client terminal 50 such as whether it exists.

  The user information acquisition processing unit 161 acquires information indicating attributes and the like of the user who has transmitted an access request to the information system 10 from the client terminal 50. For example, the user information acquisition processing unit 161 uses the user ID sent from the client terminal 50 or the information managed by the user management apparatus 101 when there is an access request from the client terminal 50. User attribute information indicating the attribute of the user is acquired. Here, a specific example of the user attribute information may be information indicating a user's name, department name, title, and the like.

  The system property information acquisition processing unit 162 acquires system property information that can specify characteristics of each device constituting the information system 10 from the system information database 154 or the like. For example, the system property information acquisition processing unit 162 includes device identification information, operation performance information, setting element information, and the like of each device constituting the information system 10 such as the servers 110-1 to 110-N, the firewall 111, and the switch 120. Is acquired as system property information. Here, a specific example of the device identification information may be information indicating the name, identification number, network address, etc. of each device constituting the information system 10. Further, as a specific example of the operation performance information, any information that can specify the type and version of each device constituting the information system 10 and the name and version of installed software may be used. Specific examples of setting element information include access right contents (for example, file readability, file editability, file writeability, program execution availability, etc.) and file usage contents (for example, readability, editing) , Whether to print, whether to copy, etc., the contents of information to be sent and received (eg, whether to send / receive emails, whether to browse WEB pages, whether to send / receive execution commands, whether to share files, file format of transfer data, transfer data , Etc.), the recipients and methods specified for sending and receiving information (such as e-mail destinations, carbon copy destinations, concealed carbon copy destinations, open port numbers, closed port numbers, address mask settings, usable protocols, etc.) Any information can be used.

  The system property information acquisition processing unit 162 may acquire all the device identification information, operation performance information, setting element information, and the like of each device constituting the information system 10 from the system information database 154, or only a part thereof. It may be acquired from the system information database 154, and other information may be acquired from each device constituting the information system 10 itself. Or you may make it acquire all the system property information from each apparatus which comprises the information system 10. FIG. In addition, the system property information acquisition processing unit 162 may acquire system property information regarding all devices constituting the information system 10, or processing to be executed in the information system 10 in response to a request from the client terminal 50. Depending on the contents of the information, system property information related to some devices constituting the information system 10 may be acquired.

  The policy determination processing unit 163 determines the policy information stored in the policy management database 153 that is necessary for setting the information system 10. For example, the policy determination processing unit 163 sets the information system 10 from the client property information acquired by the client property information acquisition processing unit 160, the user attribute information acquired by the user information acquisition processing unit 161, and the like. Determine the policy information you need. Further, the policy determination processing unit 163 identifies the content of processing to be executed in the information system 10 in response to the access request from the client terminal 50, and determines the policy information based on the identified processing content. Good. The policy information determined by the policy determination processing unit 163 is notified to the policy information determination processing unit 164.

  The policy information determination processing unit 164 reads the policy information notified from the policy determination processing unit 163 from the policy management database 153, and analyzes the read policy information. Then, it is determined whether or not related information is necessary from the result of the analysis, and if necessary, the related information is acquired. For example, the policy information determination processing unit 164 acquires the client property information acquired by the client property information acquisition processing unit 160, the user attribute information acquired by the user information acquisition processing unit 161, and the system property information acquisition processing unit 162. Select necessary information as related information from system property information. In addition, the policy information determination processing unit 164 configures the information system 10 such as the servers 110-1 to 110-N according to the content of the processing to be executed in the information system 10 in response to a request from the client terminal 50. Information related to policy information may be acquired from each device. The policy information read from the policy management database 153 by the policy information determination processing unit 164 and the related information are provided to the system setting creation processing unit 152.

  The system setting creation processing unit 152 is device setting information indicating the setting contents of each device constituting the information system 10 based on the policy information provided by the policy information determination processing unit 164 of the policy determination processing unit 151 and related information. Create For example, the system setting creation processing unit 152 analyzes the contents of the information security policy indicated by the policy information and matches each server 110-with client property information, user attribute information, system property information, etc. included in the related information. 1 to 110-N, the firewall 111, the switch 120, etc. The apparatus setting information which shows the setting content in each apparatus is produced. Then, by providing device setting information to each device constituting the information system 10, the information system 10 can be set in accordance with the information security policy.

  The policy management database 153 stores and manages the policy information acquired from the administrator terminal 102 by the policy registration processing unit 150. Here, the policy information stored in the policy management database 153 includes main policy information that defines a general information security policy independent of the system configuration of the information system 10 and the settings of each device, and is referenced in the main policy information. And sub-policy information describing specific conditions and operation rules.

  The system information database 154 stores all or part of the system property information of each device constituting the information system 10. The system property information stored in the system information database 154 can be used for creation of device setting information by the system setting creation processing unit 152.

  The user management apparatus 101 only needs to have a hardware configuration as a general electronic computer such as a workstation or a personal computer, and a directory tree conforming to a predetermined protocol such as LDAP (Lightweight Directory Access Protocol) is used. For example, the user manages predetermined information about the user. Here, specific examples of information managed by the user management apparatus 101 include user IDs, passwords, department names, job titles, group names, and information management attributes for identifying each user ( Any information indicating the degree to which information provision is permitted may be used.

  The administrator terminal 102 only needs to have a hardware configuration as a general electronic computer such as a workstation or a personal computer. The administrator terminal 102 inputs and creates policy information in response to an operation of an administrator who manages the information system 10, for example, and provides the policy information to the policy management apparatus 100. As an example, at the administrator terminal 102, an information security policy in accordance with an operation procedure document created by a company security countermeasure department (such as an information system department) is input as policy information written in a predetermined policy description language. Is done.

  The policy information input at the administrator terminal 102 may be input using an input device such as a keyboard or a mouse, or a recording medium such as a magnetic disk drive, an optical disk drive, or an IC memory interface. By using a reader, it may be read from a predetermined recording medium such as a magnetic disk, an optical disk, or an IC memory. Alternatively, the administrator terminal 102 may execute predetermined communication processing to acquire policy information, or the administrator terminal 102 may execute policy information when the administrator terminal 102 executes a predetermined application program.

  The servers 110-1 to 110 -N only have to have a hardware configuration as a general electronic computer such as a workstation or a personal computer, and perform predetermined information processing in response to a request from the client terminal 50. As long as it functions as an information processing apparatus capable of executing the above. Specific examples of the servers 110-1 to 110-N include at least one of a web server, a file server, a mail server, a database server, a DRM (Digital Rights Management) server, an SSO (Single Sign-On) server, and an application server. Anything including one is acceptable.

  The firewall 111 conceals information such as the configuration in the internal network of the information system 10 to be protected from the outside, and executes access control based on authentication at the boundary between the internal network of the information system 10 and the external network 11. In addition, it has a function that enables communication of a legitimate user while preventing entry from the outside.

  The switch 120 may be, for example, a LAN switch with an authentication function, and performs setting to connect the client terminal 50 to the business system 15 or the quarantine system 300 in the information system 10.

  The quarantine system 300 is configured using the quarantine server 30 and the like, and is connected to the client terminal 50 via a network. The quarantine system 300 may be installed separately from the business system 15. The client terminal 50 connected to the quarantine system 300 is inspected for the presence or absence of virus infection, the status of security patches, the version and operating status of definition files of anti-virus software. If the result of this inspection matches the information security policy in the information system 10, connection to the business system 15 is permitted. On the other hand, if the information security policy is not met, the client terminal 50 is updated so as to conform to the information security policy, and then the connection to the business system 15 is permitted.

  Next, the operation of the policy management apparatus 100 having the above configuration will be described. In this policy management apparatus 100, policy information describing an information security policy is registered in advance by storing policy information in the policy management database 153 based on information acquired from the administrator terminal 102 or the like by the policy registration processing unit 150. Has been.

  The client terminal 50 transmits an access request to the information system 10 by being connected to the switch 120 or by being connected to the access point 20 via the external network 11. In response to the access request from the client terminal 50, the policy management apparatus 100 executes information system setting processing as shown in the flowchart of FIG.

  When the information system setting process shown in FIG. 3 is started, first, the user information acquisition processing unit 161 determines a user based on access information from the client terminal 50, and the access information and the user management apparatus 101 User attribute information and the like are acquired from the managed information (step S101). Further, the client property information acquisition processing unit 160 acquires client property information related to the client terminal 50 from information sent from the client terminal 50 and information managed by the user management apparatus 101 (step S102).

  Subsequently, the policy determination processing unit 163 executes in the information system 10 in response to the user attribute information acquired in step S101, the client property information acquired in step S102, or the access request from the client terminal 50. Policy information necessary for setting the information system 10 is determined from the contents of the processing to be performed (step S103). The policy information determination processing unit 164 reads out and acquires the policy information determined in step S103 from the policy management database 153 (step S104). The policy information determination processing unit 164 analyzes the policy information read from the policy management database 153 (step S105).

  From the result of the analysis in step S105, the policy information determination processing unit 164 determines whether or not related information is necessary (step S106). At this time, if it is determined that the related information is necessary (step S106; Yes), the information system 10 such as the servers 110-1 to 110-N is configured with the information that is the related information of the policy information. Obtained from each device (step S107). The related information acquired in step S107 is provided to the system setting creation processing unit 152 together with the policy information. On the other hand, if it is determined in step S106 that the related information is unnecessary (step S106; No), the process of step S107 may be skipped and only the policy information may be provided to the system setting creation processing unit 152. Good. Alternatively, the user attribute information acquired in step S101 and the client property information acquired in step S102 are information different from the related information required from the analysis result of the policy information. You may make it provide to the creation process part 152. FIG.

  Further, based on the analysis result of the policy information in step S105, the system property information acquisition processing unit 162 obtains the system property information from the information stored in the system information database 154 and the information held by each device constituting the information system 10. Obtain (step S108). The system property information acquired in step S108 is provided to the system setting creation processing unit 152.

  Thereafter, the system setting creation processing unit 152 creates device setting information indicating the setting content of each device constituting the information system 10 from the information provided by each configuration of the policy determination processing unit 151 (step S109). And the setting of the information system 10 according to an information security policy is completed by providing the apparatus setting information produced to each apparatus (step S110).

  A specific example of the information security policy managed by the policy management apparatus 100 will be described below. First, an information security policy for a document will be described as a first specific example. In this case, for example, the server 110-1 is assumed to be a file server constituting the document management system.

  In this specific example, the policy registration processing unit 150 performs policy management based on main policy information corresponding to “document type” as shown in FIG. 4A and sub-policy information as shown in FIG. Stored in the database 153 in advance. The main policy information shown in FIG. 4A describes general-purpose contents independent of the actual configuration in the information system 10. For example, the main policy information M11 corresponding to the document type “top secret” The main policy information M12 corresponding to the document type “confidential” is included. The sub-policy information shown in FIG. 4B describes specific conditions referred to from the main policy information. For example, the sub-policy information S11 corresponding to the “affiliation” condition and the “post” condition Sub-policy information S12 corresponding to the "period" condition, sub-policy information S13 corresponding to the "period" condition, and sub-policy information S14 corresponding to the "environment" condition.

  Also, in the document management system configured by the server 110-1, document property information as shown in FIG. 5A is held as an example of information associated with each document. The document property information shown in FIG. 5A describes only information relating to each document managed by the document management system, and has contents independent of actual settings in the information system 10 and the document management system. I just need it. 5A includes document property information DP11 corresponding to “document XXX”, document property information DP12 corresponding to “document YYY”, and document property information DP13 corresponding to “document ZZZ”. It is.

  FIG. 5B shows an example of system property information stored in the system information database 154. The system property information shown in FIG. 5B includes “access right” system property information SP11 indicating the contents of the access right, “use of file” system property information SP12 indicating the use contents of the file, and the firewall 111. System property information SP13 of “FW setting” indicating setting contents and system property information SP14 of “mail server setting” indicating settings of mail servers included in the servers 110-1 to 110-N are included.

  Next, an information security policy for a network will be described as a second specific example. In this specific example, the policy registration processing unit 150 performs policy management on main policy information corresponding to the “network policy” as shown in FIG. 6A and sub-policy information as shown in FIG. Stored in the database 153 in advance. The main policy information shown in FIG. 6 (A) may be any information that describes general-purpose contents independent of the actual configuration in the information system 10 as in the main policy information shown in FIG. 4 (A). For example, main policy information M21 corresponding to “anti-virus” implemented in the internal network of the information system 10 and main policy information M22 corresponding to “FW setting” regarding the setting of the firewall 111 are included. The sub-policy information shown in FIG. 6B is also referred to from the main policy information in the same manner as the sub-policy information shown in FIG. 4B, and describes specific operation rules. For example, “Rule A” Sub-policy information S21 corresponding to “Rule B”, sub-policy information S22 corresponding to “Rule C”, and sub-policy information S23 corresponding to “Rule C”.

  Assume that there is an access request for browsing a document from, for example, the client terminal 50 connected to the access point 20 in a state where various types of information as described above are stored. In this case, first, the process of step S101 shown in FIG. 3 is executed, whereby the user information acquisition processing unit 161 specifies the user by acquiring the user ID from the client terminal 50 and the like. User attribute information indicating the title and department of the user is acquired from the user management apparatus 101. 3 is executed, the client property information acquisition processing unit 160 acquires client property information related to the client terminal 50. The client property information acquired at this time includes, for example, information indicating the network address of the access point 20 and the like, thereby specifying that the access from the client terminal 50 is access via the external network 11. it can. The client property information also includes information indicating the type of the client terminal 50 such as whether the client terminal 50 is a desktop personal computer, a notebook personal computer, a PDA, or a mobile phone.

  Subsequently, by executing the process of step S103 shown in FIG. 3, the policy determination processing unit 163, for example, the user's job title and department, which is specified from the user attribute information, the type of the client terminal 50, the client property Necessary for setting the information system 10 based on the fact that the access is from the external network 11 specified by the information and that the access request from the client terminal 50 is for the purpose of browsing the document. Determine policy information. 3 is executed, the policy information determination processing unit 164 acquires main policy information and sub-policy information stored in the policy management database 153, and step S105 shown in FIG. By executing the above process, the policy information is analyzed.

  As a result of the analysis in step S105, if it is determined that, for example, document property information is necessary as the related information of the policy information (step S106; Yes), the process of step S107 shown in FIG. The information determination processing unit 164 obtains document property information from the server 110-1 constituting the document management system. Further, based on the analysis result of the policy information in step S105, the system property information acquisition processing unit 162 acquires the system property information from the system information database 154 and the like by executing the processing in step S108 shown in FIG. The various information acquired in this way is provided to the system setting creation processing unit 152, and is used to create device setting information by executing the processing of step S108 in FIG.

  7A to 7C show specific examples of device setting information created by the system setting creation processing unit 152. FIG. Here, FIG. 7A shows the device setting information CF11 indicating “document restriction” which is provided to the server 110-1 constituting the document management system and defines restrictions on the use of the document file. FIG. 7B shows a “network setting” which is provided to any of the devices constituting the information system 10 (for example, any one of the servers 110-1 to 110-N) and determines settings related to the internal network of the information system 10. "Shows device setting information CF12. FIG. 7C shows the device setting information CF13 indicating “personal firewall” provided to the server 110-1 constituting the document management system, for example. The server 110-1 that has received the device setting information CF13 can perform settings for performing independent access control separately from the access control by the firewall 111.

  The policy information stored in the policy management database 153 is not only composed of main policy information and sub-policy information, but also according to the specifications of the information system 10 and the environment in which the information system 10 is installed. Various combinations may be possible so that the system setting can be performed flexibly. As a specific example, the policy information stored in the policy management database 153 is hierarchized into a plurality of upper and lower hierarchies, and in each hierarchy, each information security policy described in each main policy information or the like as one element, A plurality of elements may be defined. In this case, there is no limitation on the method of setting the hierarchy and the elements included in each hierarchy, as long as it can handle various hierarchy settings and combinations of elements as appropriate according to the situation. As an example, a hierarchy for creating system settings using client property information is provided, and a hierarchy for creating system settings using system property information is provided at a level below that hierarchy. In addition, the policy management database 153 may store policy information in which a plurality of elements can be defined in each hierarchy separated based on a certain standard.

  In addition, when the policy information determination processing unit 164 reads the main policy information and the sub policy information stored in the policy management database 153 based on the determination of the policy determination processing unit 163, a combination of a plurality of policy information One piece of policy information may be newly created. In this case as well, there is no limitation on how to set the hierarchy and the elements included in each hierarchy, and it is only necessary that the hierarchy setting and the combination of elements can be determined appropriately according to the situation. As an example, the policy information determination processing unit 164 provides a hierarchy for creating system settings using client property information, and creates system settings using system property information in a hierarchy lower than that hierarchy. For example, a plurality of elements may be defined in each layer by dividing each layer based on a certain standard, such as providing a layer for the purpose.

  In this way, by making it possible to create policy information layered in multiple upper and lower layers, it is possible to limit the impact when changing the information security policy, making it easy to manage information security policies and system settings Become. In addition, for example, information security policy definitions corresponding to a more specific system configuration can be prepared in the lower hierarchy compared to the upper hierarchy, and individual settings for each organization in the company can be made. This makes it easy to customize system settings. Furthermore, by clarifying the hierarchical relationship within the policy information, violations and contradictions of the information security policy can be prevented, and detailed operation according to the information security policy becomes possible.

  As described above, according to the present invention, the policy information necessary for setting the information system 10 is determined based on the client property information acquired by the client property information acquisition processing unit 160. Thus, for example, according to the information security policy corresponding to the environment including the type of the client terminal 50 such as whether the client terminal 50 is a desktop personal computer, a notebook personal computer, a PDA, or a mobile phone. The system 10 can be set flexibly.

  The system setting creation processing unit 152 creates device setting information from various types of information including policy information acquired by the policy determination processing unit 151. The policy information stored in the policy management database 153 includes main policy information describing general-purpose contents independent of the actual configuration in the information system 10, and specific conditions and operation rules referenced from the main policy information. It consists of the described sub-policy information. The system property information stored in the system information database 154 includes setting element information that can specify the contents of the access right. Thereby, the target to which the information security policy can be set is not limited, the information system 10 can be set flexibly according to the information security policy, and all individual device setting information is prepared in advance. Since it is not necessary, the amount of information necessary for system setting can be reduced.

  In the above specific example, the information security policy for documents and networks has been described. However, the present invention is not limited to this, and the security policy for various information such as music data, video data, application software, and the like is used. The present invention can also be applied when setting the information system 10 according to the above.

  The present invention is not limited to the above embodiment, and various modifications and applications are possible. For example, in the above-described embodiment, the policy management apparatus 100, the user management apparatus 101, the administrator terminal 102, the servers 110-1 to 110-N, the firewall 111, etc. are all on the hardware configuration as an independent computer. It has been described that the information system 10 is configured by being constructed. However, the present invention is not limited to this, and on the hardware configuration as at least one computer, the policy management apparatus 100, the user management apparatus 101, and the administrator terminal 102 described in the above embodiment. Any of the servers 110-1 to 110-N, the firewall 111, and the like can be executed. For example, the information system according to the above-described embodiment on a hardware configuration as one electronic computer. Ten configurations may be constructed. Further, the policy management apparatus 100 is not limited to the one installed inside the information system 10, and is constructed on a hardware configuration as an external electronic computer connected to the information system 10 via a telecommunication network. It may be a thing.

  Further, the policy management apparatus 100 can be realized by using a normal computer system without depending on a dedicated system. For example, a program for executing the above-described operation is stored and distributed in a computer-readable recording medium (for example, a magnetic disk, an optical disk, an IC memory, etc.), and the program is installed in the computer, whereby the above-described processing is performed. A policy management apparatus to be executed may be configured. Further, the program may be stored in an information storage device included in an arbitrary information processing device arranged on a network such as the Internet, and downloaded to a computer, for example.

It is a figure which shows one structural example of the information system to which a policy management apparatus is applied. It is a figure which shows the structural example of a policy management apparatus. It is a flowchart which shows an example of an information system setting process. It is a figure which shows a specific example of the policy information stored in a policy management database. It is a figure which shows a specific example of the document property information hold | maintained at a server, and the system property information stored in a system information database. It is a figure which shows a specific example of the policy information stored in a policy management database. It is a figure which shows a specific example of the apparatus setting information produced by a system setting production process part.

Explanation of symbols

DESCRIPTION OF SYMBOLS 10 Information system 11 External network 20 Access point 30 Quarantine server 50 Client terminal 100 Policy management apparatus 101 User management apparatus 102 Administrator terminal 110-1 to 110-N server 111 Firewall 120 Switch 150 Policy registration process part 151 Policy judgment process part 152 System setting creation processing unit 153 Policy management database 154 System information database 160 Client property information acquisition processing unit 161 User information acquisition processing unit 162 System property information acquisition processing unit 163 Policy determination processing unit 164 Policy information determination processing unit 300 Quarantine system

Claims (8)

An information system setting device for setting an information system according to an information security policy,
A policy management database that stores policy information describing information security policies;
Attribute information acquisition means for acquiring user attribute information;
Terminal property information acquisition means for acquiring property information of a terminal device that has transmitted an access request to the information system;
System property information acquisition means for acquiring property information of each device constituting the information system;
Policy information reading means for reading out the policy information stored in the policy management database based on the attribute information acquired by the attribute information acquisition means and the property information of the terminal device acquired by the terminal property information acquisition means;
The information system is set by creating setting information of the information system based on at least the policy information read by the policy information reading means and the system property information acquired by the system property information acquisition means. Comprising setting control means,
An information system setting device. The policy management database includes main policy information describing an information security policy independent of the configuration of the information system, and a sub-policy describing conditions or operation rules related to settings of the information system that are referred to by the main policy information Storing information as the policy information;
The information system setting device according to claim 1. The policy information reading means comprises the related information acquisition means for analyzing the policy information read from the policy management database and acquiring the related information of the policy information,
The setting control means sets the information system based on the related information acquired by the related information acquisition means.
The information system setting device according to claim 1, wherein the information system setting device is an information system setting device. The policy information reading means includes means for determining policy information to be read from the policy management database based on the property information of the terminal device acquired by the terminal property information acquisition means.
The information system setting device according to claim 1, 2, or 3. An information system setting method by a computer for setting an information system according to an information security policy,
A policy information storage step for storing policy information describing an information security policy in a policy management database;
An attribute information acquisition step for acquiring user attribute information;
A terminal property information acquisition step of acquiring property information of a terminal device that has transmitted an access request to the information system;
A system property information acquisition step of acquiring property information of each device constituting the information system;
A policy information reading step for reading out the policy information stored in the policy management database based on the attribute information acquired in the attribute information acquisition step and the property information of the terminal device acquired in the terminal property information acquisition step;
The information system is set by creating setting information of the information system based on at least the policy information read in the policy information reading step and the system property information acquired in the system property information acquisition step. A setting control step,
An information system setting method characterized by the above. Analyzing the policy information read in the policy information reading step, and providing a related information acquisition step of acquiring related information of the policy information;
The setting control step sets the information system based on the related information acquired in the related information acquisition step.
The information system setting method according to claim 5. On the computer that sets up the information system according to the information security policy,
Policy information storage processing for storing policy information describing an information security policy in a policy management database;
Attribute information acquisition processing for acquiring user attribute information;
Terminal property information acquisition processing for acquiring property information of a terminal device that has transmitted an access request to the information system;
System property information acquisition processing for acquiring property information of each device constituting the information system;
A policy information reading process for reading out the policy information stored in the policy management database based on the attribute information acquired in the attribute information acquisition process and the property information of the terminal device acquired in the terminal property information acquisition process;
The information system is set by creating setting information of the information system based on at least the policy information read by the policy information reading process and the system property information acquired by the system property information acquisition process. Setting control processing;
A program for running In the computer,
Analyzing the policy information read in the policy information reading process, further executing a related information acquisition process for acquiring related information of the policy information,
In the setting control process, the information system is set based on the related information acquired in the related information acquisition process.
The program according to claim 7.

Images