JP2011188071A - Intrusion detection/prevention system, client computer, intrusion detection/prevention apparatus and method, and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an intrusion detection/prevention system and the like in which deterioration in a security level and a communication velocity can be avoided by appropriately setting inspection items. <P>SOLUTION: A client computer 10 has a patch application information confirming section 102 for creating inspection unnecessary item data and a web browser operating section 101 for transmitting a connection request addressed to a web server after imparting the inspection unnecessary item data thereto. An intrusion detection/prevention apparatus 20 has: a session management section 201 for transferring the connection request from the client computer to the web server; an inspection unnecessary item writing function 202a for excluding the inspection unnecessary item data included in the connection request and writing the inspection unnecessary item data into a session table 212; an inspection execution determining function 202c for determining whether or not an inspection is required for a response packet for each of inspection items; and an inspection program reading function 202b for inspecting the response packet. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to an intrusion detection / protection system, a client computer, an intrusion detection / protection device, a method, and a program, and more particularly to an intrusion detection / protection system, a client computer, which can avoid a decrease in security level and communication speed. The present invention relates to an unauthorized intrusion detection / protection device, method, and program.

  For all computers connected to the Internet, it is no longer necessary to take measures against attacks that attempt to make unauthorized intrusions by exploiting vulnerabilities such as OS (Oparating System, basic software) and applications. According to a report by Symantec Corporation in Non-Patent Document 1, the company took measures against about 16.66 million new malicious codes (malicious programs) in the year 2008 AD. This is about 2.6 times the number of the previous year's 620,000. Of course, the threat to unauthorized intrusion is increasing at a similar pace.

  In recent years, the threat of unauthorized intrusion has increased rapidly. In addition to taking countermeasures against unauthorized intrusion at each client computer, the intranet inside the organization such as a company is connected to the global Internet (for example, proxy It is desirable to detect and prevent unauthorized intrusion by using a server, etc., because the load on each client computer is reduced. Therefore, in many organizations, an inline unauthorized intrusion detection / protection system has been adopted in order to protect an internal intranet from an unauthorized network.

  FIG. 19 is an explanatory diagram showing a configuration of a general inline-type unauthorized intrusion detection / protection system 1001. A plurality of client computers 1010A, 1010B, 1010C,... Are connected to an internal network 1030 in the organization, and the internal network 1030 is connected to the Internet 1050 via an unauthorized intrusion detection / protection device 1020. As a result, each of the client computers 1010A, 1010B, 1010C,... Can connect to the web server 1040 on the Internet 1050 and receive a web service provided by the web server 1040.

  The unauthorized intrusion detection / protection device 1020 is a so-called proxy server that mediates connection from each client computer 1010A, 1010B, 1010C,... To the web server 1040, and communication that reaches the internal network 1030 from the Internet 1050 side. The packet is inspected, and if the communication packet contains contents intended for unauthorized intrusion, the communication packet is discarded, thereby preventing unauthorized intrusion. Accordingly, each client computer 1010A, 1010B, 1010C,... Is protected from unauthorized intrusion threats.

  However, if the number of items for inspecting each communication packet in the unauthorized intrusion detection / protection device 1020 increases, the processor that performs the inspection may be overloaded, and the communication speed may be significantly reduced. In relation to this problem, there are the following technical documents. Among them, Patent Document 1 describes an unauthorized access detection device that inquires an upstream device about “security strength” in a network configuration and omits some inspection items based on the response.

  Patent Document 2 describes an information inspection apparatus that deletes points improved by correcting software vulnerabilities from inspection rules. Patent Document 3 describes a vulnerability inspection device that automatically creates data such as an HTTP (Hypertext Transfer Protocol) header. Patent Document 4 describes an inline-type intrusion detection / protection device that instructs to stop pattern matching when the packet matching time exceeds the maximum allowable delay time. Patent Document 5 discloses an inline type in which the attack detection frequency of each inspection item of a signature to be used is determined, and the inspection item is changed according to the load status of a CPU (Central Processing Unit, main arithmetic control means). An unauthorized intrusion detection / protection device is described.

JP 2009-005122 A JP 2004-139177 A JP 2005-354338 A JP 2008-066903 A JP 2008-098766 A

"Internet Security Threat Report", [online], April 2009, Symantec Corporation, [searched on February 12, 2010], Internet <URL: http://www.symantec.com/content/en/ jp / enterprise / white_papers / istr14_wp_200904.pdf>

  As described above, in the inline-type intrusion detection / protection system 1001 shown in FIG. 19, the items that the intrusion detection / protection device 1020 has to inspect for each communication packet passing through the device are rapidly increasing. Yes. Therefore, in order to inspect these many items, there is a problem that the processor that actually performs the inspection with this apparatus is overloaded, and the communication speed is greatly reduced.

  On the other hand, in the OS (Operating System) and applications that run on each of the client computers 1010A, 1010B, 1010C,..., There are a series of software correction modules called patches one after another against new threats discovered every day. Created and distributed. By applying these patches to each client computer, it is possible to cope with many unauthorized intrusion threats.

  Therefore, for items that can be dealt with by applying a patch on the client computer side, inspection is omitted on the unauthorized intrusion detection / protection device 1020 side, thereby reducing the load on the inspection and avoiding a decrease in communication speed. Is of course conceivable.

  However, the patch application status differs for each client computer, and not all necessary patches are applied to all client computers. In addition, since the OS and application used for each client computer are different, the patch to be applied is naturally different for each client computer.

  Therefore, the administrator grasps all of them and checks whether the inspection items that are increasing day by day are checked one by one to determine whether inspection is necessary or not, without reducing the security level and communication speed. Setting inspection items appropriately is already difficult in practice.

  The techniques described in Patent Documents 1 to 5 do not take into consideration that the application status of patches differs for each client computer, and it is impossible to set inspection items accordingly.

  An object of the present invention is to provide an intrusion detection / protection system, a client computer, and an intrusion detection / protection device that can appropriately set inspection items for each client computer and avoid a decrease in security level and communication speed. It is to provide a method and a program.

  In order to achieve the above object, an intrusion detection / protection system according to the present invention connects to a web server on an external network via an intrusion detection / protection device in which one or more client computers are connected through an internal network. It is possible to check whether a packet received from an external network contains an illegal attack that exploits the vulnerability of the software running on the client computer, and if the detected packet contains an illegal attack An intrusion detection and prevention system that discards packets, improved by client computers with applied patch ID information and a list of patch identifiers and patches applied to improve vulnerabilities Patch ID-inspection item pair indicating correspondence with vulnerability A first storage means for storing a table; a patch application information confirmation unit for creating inspection-unnecessary item data from the applied patch ID information and the patch ID-inspection item correspondence table; And a web browser operation unit that displays the contents of the response packet returned in response to the connection request, and the unauthorized intrusion detection / protection device is the source of the connection request from the client computer. And a second storage means for storing a session table which is data about the transmission destination, a connection request from the client computer is transferred to the web server, and the correspondence between the transmission source and the transmission destination of the connection request Is recorded in the session table, and the response packet from the web server corresponding to the connection request is recorded in the session. A session management unit that forwards to a source recorded in the table, and a packet inspection unit that inspects whether or not an illegal attack is included in the response packet from the web server. The inspection table writing function that removes the inspection unnecessary item data included in the connection request before the received connection request is transferred to the web server and writes the inspection unnecessary item data in the session table, and the session table A test execution determination function that determines whether or not inspection is required for each inspection item for the response packet based on inspection-unnecessary item data included in the connection request corresponding to the response packet, and determines that inspection is necessary The inspection program corresponding to the inspection item is read, the response packet is inspected, and the response packet is And an inspection program reading function for discarding an illegal attack if it is included in the network.

  In order to achieve the above object, a client computer according to the present invention is a client computer that can be connected to a web server on an external network via an intrusion detection / protection device connected through an internal network, Storage for storing applied patch ID information indicating a list of identifiers of patches applied to improve vulnerabilities and a patch ID-inspection item correspondence table indicating correspondence between patch identifiers and vulnerabilities improved by patches A patch application information confirmation unit that creates inspection-unnecessary item data from the applied patch ID information and the patch ID-inspection item correspondence table, and adds and transmits inspection-unnecessary item data to the connection request addressed to the web server Displays the contents of the response packet sent back in response to the request Characterized in that it has a web browser operating unit.

  In order to achieve the above object, an intrusion detection / protection device according to the present invention mediates a connection between a client computer connected through an internal network and a web server on an external network, and transmits packets received from the external network. An intrusion detection / protection device that inspects whether or not an unauthorized attack that exploits the vulnerability of software running on a client computer is included, and discards the packet if the detected packet includes an unauthorized attack Storage means for storing a session table, which is data about the source and destination of a connection request from a client computer, and transfers the connection request from the client computer to the web server and The correspondence between the sender and destination The session management unit that records the response packet from the web server corresponding to the connection request to the sender recorded in the session table, and whether the response packet from the web server contains an unauthorized attack The packet inspection unit removes the inspection unnecessary item data included in the connection request before the connection request received from the client computer is transferred to the web server, and the inspection unnecessary item. Whether or not inspection is required for each inspection item for the response packet based on the inspection unnecessary item writing function that writes data in the session table and the inspection unnecessary item data included in the connection request corresponding to the response in the session table Inspection execution determination function for determining whether or not the inspection item is determined to be inspected Examining the response packet reads the corresponding test program, and having the same and a discarding inspection program reading function if it contains illegal attack to the response packet.

  In order to achieve the above object, an unauthorized intrusion detection / protection method according to the present invention connects to a web server on an external network via an unauthorized intrusion detection / protection device in which one or more client computers are connected through an internal network. It is possible to check whether a packet received from an external network contains an illegal attack that exploits the vulnerability of the software running on the client computer, and if the detected packet contains an illegal attack An intrusion detection / protection system for discarding packets, in which a client computer has applied patch ID information and a patch identifier indicating a list of patch identifiers applied to improve previously stored vulnerabilities; Patch I showing the correspondence with the vulnerabilities improved by the patch -Creates inspection-unnecessary item data from the patch application information confirmation unit from the inspection item correspondence table, and the client computer attaches inspection-unnecessary item data to the connection request addressed to the web server and sends it to the web browser operation unit. Session table in which the intrusion detection / protection device receives a connection request from the client computer at the session management unit, and the intrusion detection / protection device stores in advance the correspondence between the source and destination of the connection request The intrusion detection / protection device writes the inspection unnecessary item data included in the connection request into the session table using the inspection unnecessary item writing function, and the intrusion detection / protection device connects. The inspection unnecessary item data is removed from the request by the inspection unnecessary item writing function, and the unauthorized intrusion detection / protection device makes the inspection unnecessary item. The connection request from which the data has been removed is transferred to the web server by the session management unit, and the unauthorized intrusion detection / protection device receives the response packet from the web server corresponding to the connection request at the session management unit. The intrusion detection / protection device uses an inspection execution determination function to determine whether or not inspection is required for each inspection item for the response packet based on the inspection unnecessary item data included in the connection request corresponding to the response packet in the session table. The unauthorized intrusion detection / protection device reads the inspection program corresponding to the inspection item determined to require inspection, inspects the response packet with the inspection program reading function, and detects intrusion detection / protection. If the device contains an illegal attack in the response packet, the device discards it using the inspection program reading function, and the unauthorized intrusion detection / protection device If the response packet does not contain an unauthorized attack, it is transferred to the client computer by the session management unit, and the client computer sends the content of the response packet transferred from the unauthorized intrusion detection / protection device to the web browser operation unit. It is characterized by being displayed.

  In order to achieve the above object, an unauthorized intrusion detection / protection program according to the present invention is connected to a web server on an external network via an unauthorized intrusion detection / protection device in which one or more client computers are connected through an internal network. It is possible to check whether a packet received from an external network contains an illegal attack that exploits the vulnerability of software running on the client computer, and the packet that was inspected contains content intended for an unauthorized attack. If there is an unauthorized intrusion detection / protection system that discards the packet if it is, applied patch ID information and a patch indicating a list of patch identifiers applied to improve vulnerabilities stored in advance in the computer Shows the correspondence between the identifier and the vulnerability improved by the patch A procedure for creating inspection-unnecessary item data from the table ID-inspection item correspondence table, a procedure for adding inspection-unnecessary item data to a connection request addressed to a web server, and a procedure transmitted from an unauthorized intrusion detection / protection device And a procedure for displaying the contents of the response packet.

  In order to achieve the above object, another unauthorized intrusion detection / protection program according to the present invention provides a web server on an external network via an unauthorized intrusion detection / protection device in which one or more client computers are connected through an internal network. The packet received from the external network is inspected whether it contains an unauthorized attack that exploits the vulnerability of the software running on the client computer, and the content intended for the unauthorized attack is in the inspected packet. In the intrusion detection / protection system that discards the packet if it is included, the procedure for receiving the connection request from the client computer and the correspondence between the connection request source and destination are stored in advance in the computer. Recorded in the session table and the connection request To write the inspection-free item data to the session table, to remove the inspection-free item data from the connection request, to transfer the connection request from which the inspection-unnecessary item data has been removed to the web server, and to the connection request Is it necessary to inspect the response packet for each inspection item based on the procedure for receiving the response packet from the web server corresponding to the request packet and the inspection unnecessary item data included in the connection request corresponding to the response packet in the session table A procedure for judging whether or not, a procedure for inspecting the response packet by reading an examination program corresponding to the examination item judged to require examination, and if the response packet contains an illegal attack The procedure for discarding this message, and if the response packet does not contain an unauthorized attack, Characterized in that to execute a step of feeding.

  As described above, according to the present invention, the client computer transmits a connection request including an inspection unnecessary item, and the unauthorized intrusion detection / protection device removes the inspection unnecessary item from the connection request and then forwards it to the web server. Since the returned response packet is inspected based on the inspection-unnecessary items, the inspection can be omitted for the inspection items to which the patch has been applied in each client computer. It is possible to provide an intrusion detection / protection system, a client computer, an intrusion detection / prevention device, a method, and a program capable of appropriately setting the security level and avoiding a decrease in security level and communication speed.

It is explanatory drawing which shows the structure of the client computer and unauthorized intrusion detection and defense apparatus which were shown in FIG. It is explanatory drawing which shows an example of the schematic structure of the whole unauthorized intrusion detection and defense system which concerns on the 1st Embodiment of this invention. It is explanatory drawing which shows the data structure of the patch ID-inspection item corresponding table shown in FIG. It is explanatory drawing which shows the data structure of the test unnecessary item list | wrist shown in FIG. It is explanatory drawing which shows the data structure of the applied patch ID list | wrist and inspection unnecessary item bit table which were shown in FIG. It is explanatory drawing which shows the HTTP request | requirement containing the HTTP request | requirement header which the HTTP header change function shown in FIG. 1 added the inspection unnecessary item information. It is explanatory drawing which shows the data structure of the patch ID-inspection item corresponding table shown in FIG. It is explanatory drawing which shows the data structure of the session table shown in FIG. It is explanatory drawing which shows the data structure of the session table containing the test unnecessary item list | wrist shown in FIG. It is explanatory drawing which shows the data structure of the site common setting data shown in FIG. 3 is a flowchart showing an operation of patch application information confirmation periodically performed by a patch application information confirmation unit shown in FIG. 1. It is a flowchart showing the operation | movement by which the HTTP header change function shown in FIG. 1 adds inspection unnecessary item information to an HTTP request header, and makes it an HTTP request header. 3 is a flowchart illustrating an operation when the session management unit and the packet inspection unit illustrated in FIG. 1 receive an HTTP request including an HTTP request header from a client computer. It is a flowchart showing operation | movement at the time of the session management part shown in FIG. 1 and a packet test | inspection part receiving an HTTP response from a web server. It is explanatory drawing which shows an example of the schematic structure of the whole unauthorized intrusion detection and defense system which concerns on the 2nd Embodiment of this invention. It is explanatory drawing which shows the structure of the client computer shown in FIG. It is explanatory drawing which shows the data structure of the applied patch ID list for asset management shown in FIG. FIG. 17 is a flowchart showing patch application information confirmation operation of the patch application information confirmation unit shown in FIG. 16. FIG. It is explanatory drawing which shows the structure of a general inline type intrusion detection and defense system.

(First embodiment)
Hereinafter, the structure of the 1st Embodiment of this invention is demonstrated based on attached FIG.
First, the basic content of the present embodiment will be described, and then more specific content will be described.
The unauthorized intrusion detection / protection system 1 according to the present embodiment can be connected to the web server 40 on the Internet 50 via the unauthorized intrusion detection / protection device 20 to which one or a plurality of client computers 10 are connected through the internal network 30. And whether the packet received from the external network contains an illegal attack that exploits the vulnerability of the software running on the client computer, and if the inspected packet contains an illegal attack, the packet Is an intrusion detection and prevention system that destroys The client computer 10 includes applied patch ID information (applied patch ID list 112) indicating a list of patch identifiers applied to improve the vulnerability, and the patch identifier and the vulnerability improved by the patch. Inspection-unnecessary item data (inspection-unnecessary item list 114) is created from the first storage unit 12 that stores the patch ID-inspection item correspondence table 111 indicating correspondence, the applied patch ID information, and the patch ID-inspection item correspondence table. A patch application information confirmation unit 102, and a web browser operation unit 111 for displaying the contents of a response packet returned in response to the connection request while adding the inspection-unnecessary item data to the connection request addressed to the web server. Have. The unauthorized intrusion detection / protection device 20 includes a second storage means 22 that stores a session table that is data about the source and destination of the connection request from the client computer, and the connection request from the client computer to the web. Transfers to the server and records the correspondence between the source and destination of the connection request in the session table, and transfers the response packet from the web server corresponding to the connection request to the source recorded in the session table. A session management unit 201 and a packet inspection unit 202 that inspects whether or not an illegal attack is included in the response packet from the web server. The packet inspection unit 202 removes the inspection-unnecessary item data included in the connection request and writes the inspection-unnecessary item data in the session table before the connection request received from the client computer is transferred to the web server. Unnecessary item writing function 202a and inspection execution for determining whether or not inspection is required for each inspection item for the response packet based on the inspection-unnecessary item data included in the connection request corresponding to the response packet in the session table A determination function 202c and an inspection that reads an inspection program corresponding to the inspection item determined to be inspected, inspects the response packet, and discards the response packet if an illegal attack is included And a program reading function 202b.

  The unauthorized intrusion detection / protection device 20 also has a correspondence table distribution unit 203 that transmits the patch ID / inspection item correspondence table 111 to the client computer 10, and the patch application information confirmation unit 102 of the client computer 10 gives in advance The patch ID / inspection item correspondence table is downloaded from the correspondence table distribution unit at a specified cycle to create inspection unnecessary item data (inspection unnecessary item list 114).

  And the 2nd memory | storage part 22 of the unauthorized intrusion detection / protection apparatus 20 has memorize | stored the site common setting (site common setting data 214) which is the setting content common to all the client computers, and an unauthorized intrusion detection / protection apparatus The 20 inspection execution determination functions 202c determine whether inspection is required for each inspection item with respect to the response packet based on the site common setting and the inspection unnecessary item data.

By providing the above configuration, this apparatus can appropriately set inspection items for each client computer.
Hereinafter, this will be described in more detail.

  FIG. 2 is an explanatory diagram showing an example of the overall schematic configuration of the unauthorized intrusion detection / defense system 1 according to the first embodiment of the present invention. In the unauthorized intrusion detection / protection system 1 according to the present embodiment, a plurality of client computers 10A, 10B, 10C,... Are connected to an unauthorized intrusion detection / protection device 20 via an internal network (intranet) 30. 10A, 10B, 10C,... Are configured to be able to communicate with the web server 40 via the Internet 50 via the unauthorized intrusion detection / protection device 20.

  FIG. 1 is an explanatory diagram showing the configuration of the client computer 10 and unauthorized intrusion detection / protection device 20 shown in FIG. The client computers 10A, 10B, 10C,... Shown in FIG. 2 all have the same configuration, so detailed description thereof is omitted in FIG.

  The client computer 10 according to the first embodiment of the present invention is a general computer device, and is a main arithmetic control means (CPU: Central Processing Unit) 11 that is a main body that executes a computer program, and a first that stores data. Storage means 12, communication means 13 for performing data communication with other computers via a network, and input / output means 14 for accepting an operation from a user and presenting a processing result.

  In the main arithmetic control means 11, the web browser operation unit 101 and the patch application information confirmation unit 102 operate as computer programs. The web browser operation unit 101 includes an HTTP (Hypertext Transfer Protocol) header changing unit 101a. The operation of these programs will be described in detail later. The first storage means 12 stores a patch ID / inspection item correspondence table 111 and an applied patch ID list 112 in advance, and the inspection unnecessary item bit table 113 and the inspection are checked by the operation of the patch application information confirmation unit 102. An unnecessary item list 114 is created and stored in the first storage unit 12. These data structures will be described in detail later.

  The unauthorized intrusion detection / protection device 20 connected to the client computer 10 via the internal network 30 is also a general computer device, and a main arithmetic control means (CPU: Central Processing Unit) 21 serving as a main body for executing a computer program, , Second storage means 22 for storing data, and communication means 23 for performing data communication with other computers via a network.

  In the main arithmetic control means 21, the session management unit 201, the packet inspection unit 202, and the correspondence table distribution unit 203 operate as computer programs. The operation of these programs will be described in detail later. The second storage unit 22 stores data such as a patch ID / inspection item correspondence table 211, a session table 212, an inspection program group 213, and site common setting data 214. These data structures will be described in detail later.

  Incidentally, the web server 40 is also a general computer device, and a web server program 41 that provides a web service operates. The web server 40 and the web server program 41 are not specifically described because they are not within the scope of the present invention.

(Overview of each part's operation)
In the client computer 10, the applied patch ID list 112 shows a list of patch IDs of patches already applied in the client computer 10. The inspection unnecessary item list 114 shows a list of items that are created based on the applied patch ID list 112 and that need not be inspected because the client computer 10 has already dealt with the vulnerability.

  The patch application information confirmation unit 102 periodically creates an applied patch ID list 112 and further creates an inspection unnecessary item list 114 from the applied patch ID list 112 and the patch ID / inspection item correspondence table 111.

  When the user operates the web browser operation unit 101 on the client computer 10 to make a web browsing request, the web browser operation unit 101 generates an HTTP request header 121 and an HTTP header change function included in the web browser operation unit 101 101 a adds information on a list of unnecessary items to the HTTP request header 121. Then, the web browser operation unit 101 transmits the HTTP request header 121a to which this information is added to the web server 40.

  In the unauthorized intrusion detection / protection device 20, when the HTTP request 120 flowing to the web server 40 is received from the client computer 10, first, the session management unit 201 first transmits the IP address, the transmission source, and the destination of the HTTP request 120. Is registered in the session table 212 as session information.

  Thereafter, the packet inspection unit 202 receives the HTTP request header 121a to which the information is added, and the inspection unnecessary item writing function 202a included in the packet inspection unit 202 extracts the inspection unnecessary item list included in the HTTP request header, The extracted inspection unnecessary item 212e is added to the corresponding entry of the session table 212, and the inspection unnecessary item list is deleted from the HTTP request header. Thereafter, an HTTP request 120 is transmitted from the packet inspection unit 202 to the web server 40.

  In response to the transmitted HTTP request 120, the web server 40 returns a response in the web server 40. The HTTP packet as the response is received by the session management unit 201 of the unauthorized intrusion detection / protection device 20, sent from there to the packet inspection unit 202, and further passed to the inspection execution determination function 202 c in the packet inspection unit 202.

  In the inspection execution determination function 202c, first, the site common setting data 214 in which the policy of the entire site is stored is read, and the inspection item is selected according to the setting contents. Next, the inspection execution determination function 202c reads the information of the inspection unnecessary item 212e from the corresponding session information in the session table 212, and the inspection is executed sequentially from the first inspection item based on the information of the inspection unnecessary item 212e. Check if it is necessary.

  In the case of an item that does not require inspection, the inspection is skipped, and in the case where inspection is necessary, a necessary inspection item program is read out from the inspection program group 213 through the inspection program reading function 202b and executed. Check for attacks that exploit vulnerabilities.

  The HTTP packet for which all necessary inspections have been completed by the packet inspection unit 202 is returned to the session management unit 201 and transmitted to the client computer 10. At this time, if this packet is the last communication, the inspection unnecessary item writing function 202a deletes the corresponding session information from the session table 212. In the client computer 10, the web browser operation unit 101 displays the content of the received HTTP response via the input / output unit 14.

(Configuration details)
As already shown in FIGS. 1 and 2, in the main calculation control means 11 of the client computer 10, the web browser operation unit 101 and the patch application information confirmation unit 102 operate as computer programs. The web browser operation unit 101 includes an HTTP header changing function 101a.

  The first storage unit 12 stores a patch ID / inspection item correspondence table 111 and an applied patch ID list 112 in advance, and an inspection unnecessary item list 114 is created by the operation of the patch application information confirmation unit 102. And stored in the first storage means 12.

  FIG. 3 is an explanatory diagram showing a data configuration of the patch ID-inspection item correspondence table 111 shown in FIG. The patch ID-inspection item correspondence table 111 is a table showing correspondence between a patch ID 111a for dealing with a vulnerability and an inspection item number 111b for detecting an attack that exploits the vulnerability. Distribution from the correspondence table distribution unit 203 of the defense device 20.

  In the example shown in FIG. 3, the correspondence between the patch ID 111a and the inspection item number 111b is shown such that the patch with the patch ID 111a = “AAAAAAA” corresponds to the vulnerability with the inspection item number 111b = 1-3. ing. Further, it is also shown that the patch ID 111a corresponding to the inspection item whose inspection item number 111b is 70 or more is not registered. This means that an item having an inspection item number 111b of 70 or more has not yet been dealt with, and thus cannot be made unnecessary.

  Here, the patch ID 111a and the inspection item number 111b corresponding to the patch ID 111a need only be unified in the unauthorized intrusion detection / protection system 1, and are given, for example, when a manufacturer of hardware or software creates a patch. Alternatively, the administrator of the unauthorized intrusion detection / protection system 1 may be given and registered in the patch ID / inspection item correspondence table 211 (details will be described later) of the unauthorized intrusion detection / protection device 20.

  FIG. 4 is an explanatory diagram showing a data structure of the inspection unnecessary item list 114 shown in FIG. The inspection unnecessary item list 114 is a list of inspection item numbers that can be determined from the patch application status of the client computer 10 that the vulnerability has already been addressed and the inspection is unnecessary. The patch application information confirmation unit 102 periodically inspects patches already applied to the client computer 10 with reference to the applied patch ID list 112, and does not need to be inspected based on the information in the patch ID / inspection item correspondence table 111. The list information of the determined inspection item numbers is output as the inspection unnecessary item list 114. The operation will be described later.

  FIG. 5 is an explanatory diagram showing a data structure of the applied patch ID list 112 and the inspection unnecessary item bit table 113 shown in FIG. The applied patch ID list 112 is data for temporarily storing a list of patch IDs already applied to the client computer 10, and the applied patch IDs in the patch ID / inspection item correspondence table 111 in FIG. It is created for each client computer 10 in the form of being enumerated.

  Since the inspection unnecessary item bit table 113 is temporary data used by the patch application information confirmation unit 102 to create the inspection unnecessary item list 114, the inspection unnecessary item bit table 113 does not necessarily have to be the example shown in FIG. The inspection unnecessary item list 114 may be created directly without creating this. In the example shown in FIG. 5, the bit position of the inspection unnecessary item bit table 113 corresponds to the inspection item number as it is, and the inspection item number No. 1 that also exists in the patch ID-inspection item correspondence table 111 of FIG. In addition, a binary number of “1” if inspection is not necessary and “0” if inspection is necessary indicates whether inspection is necessary or unnecessary for each inspection item.

  The web browser operation unit 101 transmits an HTTP request to the web server 40 when the user performs an operation for browsing the information of the web server 40, and if there is an HTTP response, the content thereof Is displayed via the input / output means 14. The HTTP header changing function 101 a adds information on the inspection unnecessary item list 114 to the HTTP request header 121 when the web browser operation unit 101 generates an HTTP request.

  FIG. 6 is an explanatory diagram showing an HTTP request 120 including an HTTP request header 121a to which the HTTP header change function 101a shown in FIG. In FIG. 6, the inspection unnecessary item information 122 is arranged in the HTTP request header 121a on the line “X-Client-Patch-Info:” with the numbers of the inspection unnecessary items listed in the inspection unnecessary item list 114. However, other formats may be used.

  As already shown in FIG. 1, in the main calculation control means 21 of the unauthorized intrusion detection / protection device 20, the session management unit 201, the packet inspection unit 202, and the correspondence table distribution unit 203 operate as computer programs. The packet inspection unit 202 includes an inspection unnecessary item writing function 202a, an inspection program reading function 202b, and an inspection execution determination function 202c.

  The second storage means 22 of the unauthorized intrusion detection / protection apparatus 20 stores data such as a patch ID / inspection item correspondence table 211, a session table 212, an inspection program group 213, and site common setting data 214. Yes. The session table 212 includes an inspection unnecessary item 212e.

  FIG. 7 is an explanatory diagram showing a data configuration of the patch ID-inspection item correspondence table 211 shown in FIG. The patch ID-inspection item correspondence table 211 is a table showing correspondence between patch IDs for dealing with vulnerabilities and inspection item numbers for detecting attacks that exploit the vulnerabilities, and correspondence table distribution The unit 203 transmits this to the patch application information confirmation unit 102 of each client computer 10 for distribution. Therefore, the data configuration of the patch ID / inspection item correspondence table 211 is the same as that of the patch ID / inspection item correspondence table 111 shown in FIG.

  By configuring the patch ID / inspection item correspondence table 211 of the unauthorized intrusion detection / protection device 20 as it is as the patch ID / inspection item correspondence table 111 of each client computer 10, the entire unauthorized intrusion detection / protection system 1 is configured. It is possible to unify between the patch ID 111a and the inspection item number 111b. When a new patch is created and an inspection item to be improved (the inspection becomes unnecessary if the patch is applied) becomes clear, the correspondence between the patch ID 111a and the inspection item number 111b is determined as an unauthorized intrusion detection / The administrator of the entire defense system 1 registers in the patch ID-inspection item correspondence table 211. In this way, the registered correspondence relationship is reflected in each client computer 10.

  FIG. 8 is an explanatory diagram showing the data structure of the session table 212 shown in FIG. The session table 212 is a table for storing session information (transmission source and destination IP addresses, transmission source and destination port numbers) for all communications in which the session is maintained at that time. The session table 212 includes a source IP address 212a, a destination IP address 212b, a source port number 212c, a destination port number 212d, and an inspection unnecessary item 212e that records the contents included in the inspection unnecessary item information 122. Retain data.

  The session management unit 201 receives communication passing through the unauthorized intrusion detection / protection device 20, writes the session information in the session table 212, and then sends the packet to the packet inspection unit 202. In addition, the session management unit 201 receives a packet that has been inspected by the packet inspection unit 202 and transfers the packet to each client computer 10.

  This operation of the session management unit 201 is general as a so-called proxy server operation. Therefore, if the computer device that operates as the proxy server is configured to operate as the unauthorized intrusion detection / protection device 20 according to the present embodiment, the present embodiment can be realized.

  The inspection program group 213 is a program group for inspecting whether a packet passing through the unauthorized intrusion detection / protection device 20 includes a packet for performing an attack exploiting vulnerability or unauthorized access. . The inspection program reading function 202b reads and operates the inspection program corresponding to the inspection item number requested by the inspection execution determination function 202c from the inspection program group 213, and executes inspection of the packet for the inspection item.

  FIG. 9 is an explanatory diagram showing a data structure of the session table 212 including the inspection unnecessary item 212e shown in FIG. When the HTTP request header 121a includes information on the inspection unnecessary item list, the inspection unnecessary item writing function 202a stores the information as an inspection unnecessary item 212e in the corresponding entry in the session table 212. After deleting the information of the inspection unnecessary item list from the HTTP request header 121 a to obtain a normal HTTP request header 121, the HTTP request is transmitted to the web server 40 through the session management unit 201.

  When the inspection execution determination function 202c receives an HTTP response from the web server 40, the inspection execution determination function 202c first reads the site common setting data 214 in which the policy of the entire site is stored, and selects an inspection item according to the setting contents. Next, the corresponding entry is searched from the session table 212, the information of the inspection unnecessary item 212e in the entry is read, and the inspection is required in order from the inspection item number 1 based on the information of the inspection unnecessary item 212e. If the inspection is not necessary, the inspection process is skipped. When inspection is necessary, the inspection execution determination function 202c reads the corresponding inspection program from the inspection program group 213 through the inspection program reading function 202b and executes packet inspection.

  FIG. 10 is an explanatory diagram showing the data structure of the site common setting data 214 shown in FIG. As described above, the site common setting data 214 is a record of the security policy of the entire unauthorized intrusion detection / protection system 1 recorded by the administrator of the entire system. Security policies are already common in computer networks used by organizations, and there are a wide variety of items. However, only the settings related to items that do not require inspection common to all client computers 10 are relevant to this embodiment. is there. For example, when there is a patch that must be set by all client computers 10, an inspection item number that does not require inspection is set here.

  Therefore, the data format is a format in which the inspection unnecessary item numbers common to all the client computers 10 are enumerated like the inspection unnecessary item list 114 shown in FIG. The inspection execution determination function 202 c determines the inspection item for each client computer 10 by combining the inspection unnecessary item number of the site common setting data 214 and the inspection unnecessary item 212 e of the session table 212.

  The session management unit 201 receives the packet that has been inspected, and transfers it to the client computer 10 corresponding to the transmission source IP address 212a and transmission source port number 212c of the entry corresponding to the packet in the session table 212.

  A web server program 41 that operates on the web server 40 is a program for a general web server such as apache, and receives an HTTP request and transmits an HTTP response according to the content of the request. . In the HTTP request transmitted from the unauthorized intrusion detection / protection device 20 to the web server 40, the HTTP request header 121 has the information of the inspection unnecessary item list 114 deleted, and thus is in accordance with the basic specifications of HTTP. Therefore, the web server program 41 does not need to be a special one corresponding to the present embodiment, and may be a normal one.

(flowchart)
FIG. 11 is a flowchart showing an operation of patch application information confirmation periodically performed by the patch application information confirmation unit 102 shown in FIG. The patch application information confirmation unit 102 performs this operation periodically, for example, once a day at a preset time.

  Upon confirming that the set time has come (step S301), the patch application information confirmation unit 102 downloads the patch ID / inspection item correspondence table 211 from the correspondence table distribution unit 203 of the unauthorized intrusion detection / protection device 20, and FIG. Are stored as the patch ID-inspection item correspondence table 111 shown in FIG. Then, the patch application information confirmation unit 102 inspects the patch applied to the client computer 10 and compares it with the patch ID / inspection item correspondence table 111 to create the applied patch ID list 112 shown in FIG. 5 (step S303). ).

  Then, the patch application information confirmation unit 102 first creates initial data of the inspection unnecessary item bit table 113 shown in FIG. 5 from the created applied patch ID list 112 (step S304). In the initial data created at this stage, all data are “1” indicating “inspection unnecessary”. The patch application information confirmation unit 102 reads the data sequentially from the top of the patch ID / inspection item correspondence table 111 (step S305), and checks whether the patch ID of the read entry exists in the applied patch ID list 112. Confirmation (step S306).

  If it exists (step S306: YES), since the patch has already been applied to the client computer 10, there is no need to inspect the corresponding inspection item. Therefore, the bit corresponding to this in the inspection unnecessary item bit table 113 remains “1”, and the processing is repeated from step S305 for the next entry.

  If it does not exist (step S306: NO), the patch has not been applied to the client computer 10, so it is necessary to inspect the corresponding inspection item. Therefore, the bit corresponding to this in the inspection unnecessary item bit table 113 is changed to “0” indicating “inspection is necessary” (step S307), and the processing is repeated from step S305 for the next entry (step S309).

  The above processing is repeated until the last entry of the patch ID / inspection item correspondence table 111 (step S308). When all entries have been processed, the information output so far as the inspection unnecessary item bit table 113 is shown in FIG. Is output as the inspection-unnecessary item list 114 shown in FIG.

  FIG. 12 is a flowchart showing the operation of the HTTP header changing function 101a shown in FIG. 1 adding the inspection unnecessary item information 122 to the HTTP request header 121 to obtain the HTTP request header 121a. When the user operates the input / output unit 14 to cause the web browser operation unit 101 to activate the web browser (step S401), the web browser operation unit 101 sends the HTTP request 120 including the HTTP request header 121 to the web server 40. (Step S402).

  The HTTP request 120 is transferred to the HTTP header changing function 101a, and the HTTP header changing function 101a responding to the HTTP request 120 reads the inspection unnecessary item list 114 output in advance, and inspects the HTTP request header 121 as shown in FIG. The unnecessary item information 122 is added and passed to the web browser operation unit 101 as an HTTP request header 121a (step S403), and the web browser operation unit 101 sends the HTTP request 120 including the HTTP request header 121a to the web server 40. (Step S405).

  FIG. 13 is a flowchart illustrating an operation when the session management unit 201 and the packet inspection unit 202 illustrated in FIG. 1 receive the HTTP request 120 including the HTTP request header 121a from the client computer 10. FIG. 13 shows the contents of the inspection unnecessary item information 122 included in the HTTP request header 121a in the session table 212 until the original HTTP request header 121 with the inspection unnecessary item information 122 removed is sent to the web server 40. Represents the operation.

  In the unauthorized intrusion detection / protection device 20, first, the session management unit 201 receives this HTTP request 120 (step S501), and includes session information (source IP address 212a, destination IP address 212b, source port number) included therein. 212c and destination port number 212d) are recorded in the session table 212 (step S502), and the HTTP request 120 is passed to the inspection unnecessary item writing function 202a in the packet inspection unit 202.

  Upon receiving the HTTP request, the inspection unnecessary item writing function 202a stores the content of the inspection unnecessary item information 122 included in the HTTP request header 121a of the HTTP request in the inspection unnecessary item 212e of the session table 212 (step S503). Then, the inspection unnecessary item information 122 is deleted from the HTTP request header 121a and returned to the original HTTP request header 121, and the HTTP request is returned to the session management unit 201 (step S504). The session management unit 201 sends the HTTP request 120 returned from the inspection unnecessary item writing function 202a to the web server 40 (step S505).

  FIG. 14 is a flowchart illustrating an operation when the session management unit 201 and the packet inspection unit 202 illustrated in FIG. 1 receive an HTTP response from the web server 40. FIG. 13 shows an operation from receiving an HTTP response from the web server 40 to checking the HTTP response, and returning the HTTP response to the client computer 10 that has transmitted the HTTP request 120 that is the basis of the HTTP response.

  In the unauthorized intrusion detection / protection device 20, first, the session management unit 201 receives this HTTP response (step S601), and passes the HTTP response to the inspection execution determination function 202c in the packet inspection unit 202 (step S602).

  Upon receiving the HTTP response, the inspection execution determination function 202c first reads the site common setting data 214, and selects an inspection item according to the setting contents (step S603). Next, the inspection execution determination function 202c searches the session table 212 for an entry corresponding to the HTTP response, reads the inspection-unnecessary item 212e of the entry (step S604), and reads each inspection item from the information read so far. It is determined whether or not the number needs to be inspected (step S605).

  When the inspection is necessary (step S605: YES), the inspection execution determination function 202c reads the inspection program corresponding to the inspection item number from the inspection program group 213 through the inspection program reading function 202b, and returns the HTTP response for the item. Inspect (step S606) and repeat the process from step S605 for the next item. As a result of the inspection, if the contents of the attack exploiting the vulnerability are included, the packet is discarded and the process is terminated (steps S607 to 608).

  When the inspection is not required (step S605: NO), the inspection execution determination function 202c does not perform the inspection for the inspection item, and repeats the process from step S605 for the next item.

  The above processing is repeated for all the inspection items (steps S609 to 610). If the details of the attack that exploits the vulnerability are not found even after the processing is completed for all the inspection items, the HTTP response is the source of the HTTP response. The client computer 10 that has transmitted the HTTP request, that is, the client computer 10 that corresponds to the source IP address 212a and the source port number 212c of the entry corresponding to the HTTP request 120 that is the source of the HTTP response in the session table 212. (Step S611), and the process ends.

  At the same time, the session management unit 201 deletes the corresponding entry in the session table 212 when the HTTP response is the last packet corresponding to the HTTP request 120. The client computer 10 displays the content of the HTTP response received by the web browser operation unit 101.

(Overall operation of the first embodiment)
Next, the overall operation of the above embodiment will be described. The unauthorized intrusion detection / protection method according to the present embodiment can be connected to a web server on an external network via an unauthorized intrusion detection / protection device 20 in which one or more client computers 10 are connected through an internal network 30. Inspect whether a packet received from an external network contains an illegal attack that exploits the vulnerability of software running on the client computer, and if the detected packet contains an illegal attack, discard the packet In the unauthorized intrusion detection / prevention system 1, the client computer is improved with applied patch ID information indicating a list of patch identifiers applied to improve vulnerabilities stored in advance, and patch identifiers and patches. Patch ID that indicates the correspondence with a specific vulnerability-inspection item The patch application information confirmation unit creates the inspection unnecessary item data from the response table (FIG. 11, steps S303 to S310), and the client computer adds the inspection unnecessary item data to the connection request addressed to the web server, and the web browser operation unit (FIG. 12, steps S402 to 405), the unauthorized intrusion detection / protection device receives a connection request from the client computer at the session management unit (FIG. 13, step S501), and the unauthorized intrusion detection / protection device. Records the correspondence between the connection request source and destination in the session table stored in advance in the session management unit (FIG. 13, step S502), and the intrusion detection / protection device is included in the connection request. Write the inspection unnecessary item data into the session table with the inspection unnecessary item writing function (see Fig. 13 S503), the unauthorized intrusion detection / protection device removes the inspection unnecessary item data from the connection request by the inspection unnecessary item writing function (FIG. 13, step S504), and the unauthorized intrusion detection / protection device removes the inspection unnecessary item data. The removed connection request is transferred to the web server by the session management unit (FIG. 13, step S505), and the unauthorized intrusion detection / protection device sends a response packet from the web server corresponding to the connection request to the session management unit. (FIG. 14, step S601), and the unauthorized intrusion detection / protection device performs, for each inspection item, on the response packet based on the inspection unnecessary item data included in the connection request corresponding to the response packet in the session table. Whether or not inspection is necessary is determined by the inspection execution determination function (FIG. 14, steps S603 to 605), and an unauthorized intrusion detection / protection device is determined. However, the inspection program corresponding to the inspection item determined to be inspected is read and the response packet is inspected by the inspection program reading function (FIG. 14, step S606). If the response packet contains an unauthorized attack, it is discarded by the inspection program reading function (FIG. 14, steps S607 to 608), and the unauthorized intrusion detection / protection device includes an unauthorized attack in the response packet. If not, it is transferred to the client computer by the session management unit (FIG. 14, step S611), and the client computer transmits the contents of the response packet transferred from the unauthorized intrusion detection / protection device to the web browser operation unit. indicate.

Here, each of the above operation steps is programmed so as to be executable by a computer, and these are executed by the client computer 10 and the unauthorized intrusion detection / protection device 20 which are computers that directly execute the respective steps. Good.
With this configuration and operation, the present embodiment has the following effects.

  According to the present embodiment, it is possible to set inspection-unnecessary items in accordance with patch application statuses that are different for each client computer, and to inspect response packets. For this reason, since the inspection can be appropriately omitted for the inspection items for which the vulnerability has already been addressed on the client computer side, the security level is not lowered. Nevertheless, since the load on the inspection can be reduced on the unauthorized intrusion detection / protection device side, it is possible to avoid a decrease in communication speed.

(Second Embodiment)
The unauthorized intrusion detection / defense system 701 according to the second embodiment of the present invention has an asset management patch application information confirmation unit 803 in which the client computer 710 creates applied patch ID information data for the purpose of computer asset management. Then, the patch application information confirmation unit 802 acquires the applied patch ID information data 815 from the asset management patch application information confirmation unit 803.

As a result, the load on the client computer 710 for creating the applied patch ID list 112 can be omitted.
Hereinafter, this will be described in more detail.

  FIG. 15 is an explanatory diagram showing an example of an overall schematic configuration of an unauthorized intrusion detection / protection system 701 according to the second embodiment of the present invention. The unauthorized intrusion detection / protection system 701 according to the present embodiment includes a plurality of client computers 10A, 10B, 10C,... , 710B, 710C,... Since they all have the same configuration, they are hereinafter collectively referred to as a client computer 710.

  All other elements are the same as those in the unauthorized intrusion detection / protection system 1 according to the first embodiment. Further, the client computer 710 according to the second embodiment and the client computer 10 according to the first embodiment may be mixed in the same internal network 30.

  FIG. 16 is an explanatory diagram showing the configuration of the client computer 710 shown in FIG. The client computer 710 includes a main calculation control unit 11, a first storage unit 12, a communication unit 13, and an input / output unit 14 that are exactly the same as the client computer 10 according to the first embodiment.

  However, the computer program operated by the main arithmetic control unit 11 is the same as the first embodiment in the web browser operation unit 101, but the patch application information confirmation unit 102 is changed to the patch application information confirmation unit 802, and further for asset management. A patch application information confirmation unit 803 is added. In addition to the patch ID / inspection item correspondence table 111 and the applied patch ID list 112, the asset management applied patch ID list 815 is added to the data stored in the first storage unit 12 in advance. . Except for these points, the configuration is the same as that of the client computer 10 according to the first embodiment, and therefore, the same reference numerals are assigned to the same elements.

  The asset management patch application information confirmation unit 803 is a program for confirming the patch application status of the client computer 710 that has already been introduced for the purpose of asset management of the computer. The asset management applied patch ID list 815 is data that the asset management patch application information confirmation unit 803 creates and stores for the purpose of asset management. FIG. 17 is an explanatory diagram showing a data configuration of the asset management applied patch ID list 815 shown in FIG. The data configuration and content of the applied patch ID list 815 for asset management are the same as the applied patch ID list 112 shown in FIG.

  FIG. 18 is a flowchart showing the patch application information confirmation operation of the patch application information confirmation unit 802 shown in FIG. Since this operation is almost the same as the operation of the patch application information confirmation unit 102 shown in FIG. 11, the same operation is referred to by the same step number. After performing the operations in steps S301 to S302, the patch application information confirmation unit 802 requests the asset management patch application information confirmation unit 803 to transmit the asset management applied patch ID list 815 (step S903). The asset management patch application information confirmation unit 803 transfers this to the patch application information confirmation unit 802 (step S904).

  As shown in FIG. 17, the asset management applied patch ID list 815 has the same data structure as the applied patch ID list 112 shown in FIG. 5, and the contents can also be used as it is for the processing after step S304. Therefore, the patch application information confirmation unit 802 uses this to perform the processing after step S304.

  In addition to being able to obtain the same effects as those described in the first embodiment, the present embodiment uses the applied patch ID list already created for the purpose of asset management as it is. Since the applied patch ID list is not duplicated, the load on the client computer 710 can be omitted.

  The present invention has been described with reference to the specific embodiments shown in the drawings. However, the present invention is not limited to the embodiments shown in the drawings, and any known hitherto provided that the effects of the present invention are achieved. Even if it is a structure, it is employable.

  About each embodiment mentioned above, it is as follows when the summary of the novel technical content is put together. In addition, although part or all of the said embodiment is summarized as follows as a novel technique, this invention is not necessarily limited to this.

(Supplementary Note 1) One or more client computers can be connected to a web server on an external network via an unauthorized intrusion detection / protection device connected through an internal network, and the client computer receives packets received from the external network. An intrusion detection / protection system that inspects whether or not an unauthorized attack that exploits the vulnerability of software that operates on the network is included, and discards the packet if the inspected packet includes the unauthorized attack There,
The client computer is
Applied patch ID information indicating a list of identifiers of patches applied to improve the vulnerability, and a patch ID-inspection item correspondence table indicating correspondence between the identifier of the patch and the vulnerability improved by the patch First storage means for storing;
A patch application information confirmation unit that creates inspection unnecessary item data from the applied patch ID information and the patch ID-inspection item correspondence table;
A web browser operation unit for displaying the contents of a response packet returned in response to the connection request and sending the connection request addressed to the web server with the inspection-unnecessary item data attached thereto;
The unauthorized intrusion detection / protection device
Second storage means for storing a session table that is data about the source and destination of a connection request from the client computer;
The connection request from the client computer is transferred to the web server, and the correspondence between the source and destination of the connection request is recorded in the session table, and the response from the web server corresponding to the connection request A session manager that forwards packets to the source recorded in the session table;
A packet inspection unit that inspects whether or not the unauthorized attack is included in a response packet from the web server,
The packet inspection unit
Before the connection request received from the client computer is transferred to the web server, the inspection unnecessary item data included in the connection request is removed and the inspection unnecessary item data is written in the session table. Built-in function,
An inspection execution determination function for determining whether or not inspection is required for each inspection item for the response packet based on inspection-free item data included in the connection request corresponding to the response packet in the session table; ,
An inspection program reading function that reads an inspection program corresponding to the inspection item determined to be inspected, inspects the response packet, and discards the fraudulent attack if the response packet includes the illegal attack; An intrusion detection / protection system characterized by having

(Supplementary Note 2) The unauthorized intrusion detection / protection device has a correspondence table distribution unit that transmits the patch ID-inspection item correspondence table to the client computer,
The patch application information confirmation unit of the client computer downloads the patch ID-inspection item correspondence table from the correspondence table distribution unit at a predetermined period to create the inspection unnecessary item data. The unauthorized intrusion detection / protection system according to Appendix 1.

(Additional remark 3) The 2nd memory | storage part of the said unauthorized intrusion detection and defense apparatus has memorize | stored the site common setting which is the setting content common to all the said client computers,
The inspection execution determination function of the unauthorized intrusion detection / protection device determines whether inspection is required for each inspection item for the response packet based on the site common setting and the inspection unnecessary item data. The unauthorized intrusion detection / protection system according to appendix 1.

(Appendix 4) The client computer is
An asset management patch application information confirmation unit that creates the applied patch ID information data for the purpose of computer asset management;
The unauthorized intrusion detection / protection system according to appendix 1, wherein the patch application information confirmation unit acquires the applied patch ID information data from the asset management patch application information confirmation unit.

(Appendix 5) A client computer that can be connected to a web server on an external network via an intrusion detection / protection device connected through an internal network,
Applied patch ID information indicating a list of identifiers of patches applied to improve vulnerabilities of operating software, and patch ID-inspection items indicating correspondence between the identifiers of the patches and the vulnerabilities improved by the patches Storage means for storing the correspondence table;
A patch application information confirmation unit that creates inspection unnecessary item data from the applied patch ID information and the patch ID-inspection item correspondence table;
And a web browser operation unit for displaying the content of a response packet returned in response to the connection request, while transmitting the inspection-unnecessary item data to the connection request addressed to the web server. Client computer.

(Supplementary Note 6) An unauthorized agent that mediates a connection between a client computer connected through an internal network and a web server on an external network, and exploits a vulnerability of software operating on the client computer in a packet received from the external network An intrusion detection / protection device that inspects whether or not an attack is included and discards the packet if the inspected packet includes the unauthorized attack,
Storage means for storing a session table that is data about the source and destination of a connection request from the client computer;
The connection request from the client computer is transferred to the web server, and the correspondence between the source and destination of the connection request is recorded in the session table, and the response from the web server corresponding to the connection request A session manager that forwards packets to the source recorded in the session table;
A packet inspection unit that inspects whether or not the unauthorized attack is included in a response packet from the web server,
The packet inspection unit
Before the connection request received from the client computer is transferred to the web server, the inspection unnecessary item data included in the connection request is removed and the inspection unnecessary item data is written in the session table. Built-in function,
An inspection execution determination function that determines whether or not inspection is required for each inspection item for the response packet based on inspection-free item data included in the connection request corresponding to the response in the session table;
An inspection program reading function that reads an inspection program corresponding to the inspection item determined to be inspected, inspects the response packet, and discards the fraudulent attack if the response packet includes the illegal attack; An unauthorized intrusion detection / defense device characterized by comprising:

(Supplementary Note 7) One or more client computers can be connected to a web server on an external network via an unauthorized intrusion detection / protection device connected through an internal network, and the client computer receives packets received from the external network. In an intrusion detection / protection system that inspects whether or not an illegal attack that exploits the vulnerability of software that operates on the network is included, and discards the packet if the inspected packet includes the unauthorized attack There,
Applied patch ID information indicating a list of patch identifiers applied to improve the vulnerability stored in advance by the client computer, and correspondence between the patch identifier and the vulnerability improved by the patch The patch application information confirmation unit creates inspection unnecessary item data from the patch ID-inspection item correspondence table indicating
The client computer gives the inspection-unnecessary item data to the connection request addressed to the web server and transmits it in the web browser operation unit,
The unauthorized intrusion detection / protection device receives a connection request from the client computer at a session management unit,
The unauthorized intrusion detection / protection device records the correspondence between the connection request source and destination in a session table stored in advance in the session management unit,
The unauthorized intrusion detection / protection device writes the inspection unnecessary item data included in the connection request into the session table with an inspection unnecessary item writing function,
The unauthorized intrusion detection / protection device removes the inspection unnecessary item data from the connection request by the inspection unnecessary item writing function,
The unauthorized intrusion detection / protection device forwards the connection request from which the inspection unnecessary item data has been removed to the web server in the session management unit,
The unauthorized intrusion detection / protection device receives a response packet from the web server corresponding to the connection request at the session management unit,
Whether the intrusion detection / protection device needs to inspect each response item for the response packet based on the inspection-unnecessary item data included in the connection request corresponding to the response packet in the session table. Is determined by the inspection execution determination function,
The unauthorized intrusion detection / protection device reads an inspection program corresponding to the inspection item determined to be inspected, and inspects the response packet with an inspection program reading function,
If the unauthorized intrusion detection / protection device includes the unauthorized attack in the response packet, it is discarded by the inspection program reading function,
If the unauthorized intrusion detection / protection device does not contain the unauthorized attack in the response packet, it transfers this to the client computer in the session management unit,
An unauthorized intrusion detection / protection method, wherein the client computer displays the content of the response packet transferred from the unauthorized intrusion detection / protection device on the web browser operation unit.

(Supplementary Note 8) One or a plurality of client computers can be connected to a web server on an external network via an unauthorized intrusion detection / protection device connected via an internal network, and the client computer is included in a packet received from the external network. Intrusion detection that inspects whether or not an illegal attack that exploits the vulnerability of software that operates on the Internet is included, and discards the packet if the inspected packet includes content intended for the unauthorized attack・ In the defense system,
On the computer,
Applied patch ID information indicating a list of identifiers of patches applied to improve the vulnerabilities stored in advance, and patch IDs indicating correspondence between the identifiers of the patches and the vulnerabilities improved by the patches Procedure to create inspection unnecessary item data from inspection item correspondence table,
A procedure for sending the connection request addressed to the web server with the inspection unnecessary item data being transmitted,
An illegal intrusion detection / protection program that executes a procedure for displaying the contents of a response packet transferred from the unauthorized intrusion detection / protection device.

(Supplementary Note 9) One or a plurality of client computers can be connected to a web server on an external network via an unauthorized intrusion detection / protection device connected via an internal network, and the client computer is included in a packet received from the external network. Intrusion detection that inspects whether or not an illegal attack that exploits the vulnerability of software that operates on the Internet is included, and discards the packet if the inspected packet includes content intended for the unauthorized attack・ In the defense system,
On the computer,
Receiving a connection request from the client computer;
A procedure for recording a correspondence relationship between a transmission source and a transmission destination of the connection request in a pre-stored session table;
A procedure for writing the inspection unnecessary item data included in the connection request in the session table;
A procedure for removing the inspection unnecessary item data from the connection request;
Transferring the connection request from which the inspection-unnecessary item data has been removed to the web server;
Receiving a response packet from the web server corresponding to the connection request;
A procedure for determining whether or not inspection is required for each inspection item for the response packet based on the inspection-unnecessary item data included in the connection request corresponding to the response packet in the session table;
A procedure for inspecting the response packet by reading an inspection program corresponding to the inspection item determined to be inspected;
A procedure for discarding the malicious attack if the response packet includes the malicious attack;
An unauthorized intrusion detection / protection program that executes a procedure for transferring the response packet to the client computer if the unauthorized attack is not included in the response packet.

  The present invention can be applied to countermeasures against unauthorized intrusion of a computer connected to a network.

DESCRIPTION OF SYMBOLS 1,701 Intrusion detection / protection system 10, 10A, 10B, 10C, 710, 710A, 710B, 710C Client computer 11, 21 Main arithmetic control means 12 First storage means 22 Second storage means 13, 23 Communication means DESCRIPTION OF SYMBOLS 14 Input / output means 20 Unauthorized intrusion detection / protection device 30 Internal network 40 Web server 41 Web server program 50 Internet 101 Web browser operation part 101a HTTP header change function 102, 802 Patch application information confirmation part 111, 211 Table 111a Patch ID
111b inspection item number 112 applied patch ID list 113 inspection unnecessary item bit table 114 inspection unnecessary item list 120 HTTP request 121, 121a HTTP request header 122 inspection unnecessary item information 201 session management unit 202 packet inspection unit 202a inspection unnecessary item writing function 202b Inspection program reading function 202c Inspection execution determination function 203 Corresponding table distribution unit 212 Session table 212e Inspection unnecessary items 213 Inspection program group 214 Site common setting data 803 Asset management patch application information confirmation unit 815 Asset management applied patch ID list

Claims (9)

Software that can be connected to a web server on an external network via an unauthorized intrusion detection / protection device in which one or more client computers are connected through an internal network, and that operates on the client computer in packets received from the external network An intrusion detection / protection system that inspects whether or not an illegal attack that exploits the vulnerability of the above is included and discards the packet if the inspected packet includes the unauthorized attack,
The client computer is
Applied patch ID information indicating a list of identifiers of patches applied to improve the vulnerability, and a patch ID-inspection item correspondence table indicating correspondence between the identifier of the patch and the vulnerability improved by the patch First storage means for storing;
A patch application information confirmation unit that creates inspection unnecessary item data from the applied patch ID information and the patch ID-inspection item correspondence table;
A web browser operation unit for displaying the contents of a response packet returned in response to the connection request and sending the connection request addressed to the web server with the inspection-unnecessary item data attached thereto;
The unauthorized intrusion detection / protection device
Second storage means for storing a session table which is data about a source and destination of a connection request from the client computer;
The connection request from the client computer is transferred to the web server, and the correspondence between the source and destination of the connection request is recorded in the session table, and the response from the web server corresponding to the connection request A session manager that forwards packets to the source recorded in the session table;
A packet inspection unit that inspects whether or not the unauthorized attack is included in a response packet from the web server,
The packet inspection unit
Before the connection request received from the client computer is transferred to the web server, the inspection unnecessary item data included in the connection request is removed and the inspection unnecessary item data is written in the session table. Built-in function,
An inspection execution determination function for determining whether or not inspection is required for each inspection item for the response packet based on inspection-free item data included in the connection request corresponding to the response packet in the session table; ,
An inspection program reading function that reads an inspection program corresponding to the inspection item determined to be inspected, inspects the response packet, and discards the fraudulent attack if the response packet includes the illegal attack; An intrusion detection / protection system characterized by having The unauthorized intrusion detection / protection device has a correspondence table distribution unit that transmits the patch ID-inspection item correspondence table to the client computer;
The patch application information confirmation unit of the client computer downloads the patch ID-inspection item correspondence table from the correspondence table distribution unit at a predetermined period to create the inspection unnecessary item data. The unauthorized intrusion detection / protection system according to claim 1. The second storage unit of the unauthorized intrusion detection / protection device stores a site common setting which is a setting content common to all the client computers,
The inspection execution determination function of the unauthorized intrusion detection / protection device determines whether inspection is required for each inspection item for the response packet based on the site common setting and the inspection unnecessary item data. The unauthorized intrusion detection / protection system according to claim 1. The client computer is
An asset management patch application information confirmation unit that creates the applied patch ID information data for the purpose of computer asset management;
The unauthorized intrusion detection / defense system according to claim 1, wherein the patch application information confirmation unit acquires the applied patch ID information data from the asset management patch application information confirmation unit. A client computer that can be connected to a web server on an external network via an intrusion detection / protection device connected via an internal network,
Applied patch ID information indicating a list of identifiers of patches applied to improve vulnerabilities of operating software, and patch ID-inspection items indicating correspondence between the identifiers of the patches and the vulnerabilities improved by the patches Storage means for storing the correspondence table;
A patch application information confirmation unit that creates inspection unnecessary item data from the applied patch ID information and the patch ID-inspection item correspondence table;
And a web browser operation unit for displaying the content of a response packet returned in response to the connection request, while transmitting the inspection-unnecessary item data to the connection request addressed to the web server. Client computer. An illegal attack that mediates the connection between the client computer connected through the internal network and the web server on the external network and exploits the vulnerability of the software operating on the client computer in the packet received from the external network is included. An unauthorized intrusion detection / protection device that inspects whether or not the packet is inspected if the unauthorized attack is included in the packet,
Storage means for storing a session table that is data about the source and destination of a connection request from the client computer;
The connection request from the client computer is transferred to the web server, and the correspondence between the source and destination of the connection request is recorded in the session table, and the response from the web server corresponding to the connection request A session manager that forwards packets to the source recorded in the session table;
A packet inspection unit that inspects whether or not the unauthorized attack is included in a response packet from the web server,
The packet inspection unit
Before the connection request received from the client computer is transferred to the web server, the inspection unnecessary item data included in the connection request is removed and the inspection unnecessary item data is written in the session table. Built-in function,
An inspection execution determination function that determines whether or not inspection is required for each inspection item for the response packet based on inspection-free item data included in the connection request corresponding to the response in the session table;
An inspection program reading function that reads an inspection program corresponding to the inspection item determined to be inspected, inspects the response packet, and discards the fraudulent attack if the response packet includes the illegal attack; An unauthorized intrusion detection / defense device characterized by comprising: Software that can be connected to a web server on an external network via an unauthorized intrusion detection / protection device in which one or more client computers are connected through an internal network, and that operates on the client computer in packets received from the external network In an intrusion detection / protection system that inspects whether or not an illegal attack that exploits the vulnerabilities is included, and discards the packet if the inspected packet includes the unauthorized attack,
Applied patch ID information indicating a list of patch identifiers applied to improve the vulnerability stored in advance by the client computer, and correspondence between the patch identifier and the vulnerability improved by the patch The patch application information confirmation unit creates inspection unnecessary item data from the patch ID-inspection item correspondence table indicating
The client computer gives the inspection-unnecessary item data to the connection request addressed to the web server and transmits it in the web browser operation unit,
The unauthorized intrusion detection / protection device receives a connection request from the client computer at a session management unit,
The unauthorized intrusion detection / protection device records the correspondence between the connection request source and destination in a session table stored in advance in the session management unit,
The unauthorized intrusion detection / protection device writes the inspection unnecessary item data included in the connection request into the session table with an inspection unnecessary item writing function,
The unauthorized intrusion detection / protection device removes the inspection unnecessary item data from the connection request by the inspection unnecessary item writing function,
The unauthorized intrusion detection / protection device forwards the connection request from which the inspection unnecessary item data has been removed to the web server in the session management unit,
The unauthorized intrusion detection / protection device receives a response packet from the web server corresponding to the connection request at the session management unit,
Whether the intrusion detection / protection device needs to inspect each response item for the response packet based on the inspection-unnecessary item data included in the connection request corresponding to the response packet in the session table. Is determined by the inspection execution determination function,
The unauthorized intrusion detection / protection device reads an inspection program corresponding to the inspection item determined to be inspected, and inspects the response packet with an inspection program reading function,
If the unauthorized intrusion detection / protection device includes the unauthorized attack in the response packet, it is discarded by the inspection program reading function,
If the unauthorized intrusion detection / protection device does not contain the unauthorized attack in the response packet, it transfers this to the client computer in the session management unit,
An unauthorized intrusion detection / protection method, wherein the client computer displays the content of the response packet transferred from the unauthorized intrusion detection / protection device on the web browser operation unit. Software that can be connected to a web server on an external network via an unauthorized intrusion detection / protection device in which one or more client computers are connected through an internal network, and that operates on the client computer in packets received from the external network An intrusion detection / protection system that inspects whether or not an illegal attack that exploits the vulnerabilities is included, and discards the packet if the inspected packet includes content intended for the unauthorized attack There,
On the computer,
Applied patch ID information indicating a list of identifiers of patches applied to improve the vulnerabilities stored in advance, and patch IDs indicating correspondence between the identifiers of the patches and the vulnerabilities improved by the patches Procedure to create inspection unnecessary item data from inspection item correspondence table,
A procedure for sending the connection request addressed to the web server with the inspection unnecessary item data being transmitted,
An illegal intrusion detection / protection program that executes a procedure for displaying the contents of a response packet transferred from the unauthorized intrusion detection / protection device. Software that can be connected to a web server on an external network via an unauthorized intrusion detection / protection device in which one or more client computers are connected through an internal network, and that operates on the client computer in packets received from the external network An intrusion detection / protection system that inspects whether or not an illegal attack that exploits the vulnerabilities is included, and discards the packet if the inspected packet includes content intended for the unauthorized attack There,
On the computer,
Receiving a connection request from the client computer;
A procedure for recording a correspondence relationship between a transmission source and a transmission destination of the connection request in a pre-stored session table;
A procedure for writing the inspection unnecessary item data included in the connection request in the session table;
A procedure for removing the inspection unnecessary item data from the connection request;
Transferring the connection request from which the inspection-unnecessary item data has been removed to the web server;
Receiving a response packet from the web server corresponding to the connection request;
A procedure for determining whether or not inspection is required for each inspection item for the response packet based on the inspection-unnecessary item data included in the connection request corresponding to the response packet in the session table;
A procedure for inspecting the response packet by reading an inspection program corresponding to the inspection item determined to be inspected;
A procedure for discarding the malicious attack if the response packet includes the malicious attack;
An unauthorized intrusion detection / protection program that executes a procedure for transferring the response packet to the client computer if the unauthorized attack is not included in the response packet.

Images