JP2012124787A - Access management system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an access management system that dispenses with the storage of an encryption key while ensuring confidentiality of log information.SOLUTION: An access management server 16 includes: log information generation means 20 for generating a full text log describing a history of operation between a client terminal 12 and an EC server 14 and a summary log as an index; a hash value generation section 22 for generating hash values of the full text log and summary log; an encryption key generation section 28 for generating an encryption key from the hash values and a pass phrase; an encryption processing section 30 for encrypting the full text log with the encryption key and deleting the encryption key from memory; and a log information storage section 32 for storing the encrypted full text log and the summary log in a log information memory section 34. When a request to browse a full text log is input from a management terminal 17, the encryption key generation section 28 regenerates an encryption key from the hash values of a corresponding full text log and summary log and the pass phrase, and a decryption processing section 44 uses the encryption key to decrypt the full text log and deletes the encryption key from memory.

Description

  The present invention relates to an access management system, and more particularly to an access management system having a function of storing data exchange between a client terminal and a server as log information in an external storage device.

  From the viewpoint of ensuring security and realizing internal control, it is recommended that data exchanges between the client terminal and the server be recorded on an external storage device one by one. There are no devices or services to realize this. Already put into practical use.

FIG. 7 is a block diagram showing a usage form of a conventional access management system, in which an access management server 60 is interposed between a client terminal 12 operated by a user and an EC (Electronic Commerce) server 14 used by the user. The state of being done is drawn. The access management server 60 has a function of recording the exchange of data generated between the client terminal 12 and the EC server 14 on an external storage device such as a hard disk one by one as log information.
Since such log information includes important personal information such as an ID, password, and credit card number, it is desirable that the log information be encrypted and stored in an external storage device.

  For example, when a failure occurs in the system, the maintenance staff connects to the access management server 60 from the maintenance terminal 18 and tries to check and restore the current state of the system. At this time, the external storage device may be accessed as necessary. However, if the log information is encrypted in advance, it is possible to effectively prevent unauthorized maintenance personnel from recognizing the contents of the log.

  On the other hand, since the administrator of the access management server 60 is authorized to view log information, the specific log information stored in the external storage device is logged in from the management terminal 17 to the access management server 60. Is specified, the log information is decrypted by the cryptographic processing system in the access management server 60, and then transmitted to the management terminal 17. As a result, the administrator can check the log information at any time.

By the way, when encrypting log information, a so-called “encryption key” is used as secret data for controlling the encryption algorithm. If this encryption key leaks to the outside, it is encrypted to a malicious third party. Since there is a risk that the sentence is deciphered, it is usually entrusted to the external encryption key management system 62 without being stored in the access management server 60 (see Non-Patent Document 1).
Encryption Key Management System “KeyMeister” Internet URL: http://jp.fujitsu.com/group/fip/services/safeport/keymeister/ Search date: November 26, 2010

Thus, by entrusting the storage of the encryption key to the external encryption key management system 62, the confidentiality of the log information is surely ensured. Extra costs such as license fees will increase.
The present invention has been devised in view of such a situation, and an object of the present invention is to realize an access management system that ensures the secrecy of log information and does not need to store an encryption key.

In order to achieve the above object, an access management system according to claim 1 is an access management system interposed between a client terminal and a server, and describes a full text of an operation log exchanged between the client and the server. Generating a full-text log and a summary log that is an index of the full-text log in session units, generating a hash value of a predetermined number of bits based on the description content of the full-text log, and based on the description content of the summary log Generating a hash value having a predetermined number of bits, and generating a cryptographic key having a predetermined number of bits based on at least the hash value of the full-text log and the hash value of the summary log, and a hash value generation unit that stores the hash value in a hash value storage unit 1 encryption key generating means, means for encrypting the full-text log using the encryption key, and the encryption key From the memory, a means for storing the encrypted full-text log in the log information storage means, and a log information browsing request for a specific session is input from the management terminal operated by the administrator. At the same time, a means for obtaining the hash value of the corresponding full-text log and the hash value of the summary log from the hash value storage means, and at least the same encryption key as the above based on the hash value of the full-text log and the hash value of the summary log Second encryption key generation means for generating, means for decrypting the encrypted full-text log using this encryption key, means for deleting the encryption key from the memory, and managing the decrypted full-text log And a means for transmitting to the terminal.
The first encryption key generation unit and the second encryption key generation unit have the same encryption key generation algorithm. Further, the processing of the second encryption key generation means may be configured so that the first encryption key generation means also serves as the process.

  An access management system according to claim 2 is based on the system of claim 1 and further comprises passphrase storage means for storing a passphrase made up of a predetermined character string. The means and the second encryption key generation means generate the encryption key using the passphrase in addition to the hash value of the full-text log and the hash value of the summary log.

  The access management system according to claim 3 is based on the system of claim 2 and is characterized in that the passphrase is composed of character strings generated based on passwords of two or more administrators.

  According to the access management system of claim 1, when encrypting the full-text log, the session is based on the hash value generated from the full-text log and the hash value generated from the access log related to the full-text log. A unique encryption key is generated on the spot and deleted from the memory when encryption is completed, and is not stored in an external storage device. In addition, when decrypting each full-text log, the encryption key unique to the session is regenerated on the spot based on the hash value of the full-text log, the hash value of the access log related to the full-text log, and the passphrase. Thus, when the decryption is completed, it is deleted from the memory, and is not stored in the external storage device. For this reason, storage and management itself of the encryption key can be made unnecessary.

  According to the access management system of claim 2, when generating an encryption key, in addition to the hash value of the full-text log and the hash value of the summary log, any passphrase can be conditioned as an essential component. It becomes possible to make the detection of the encryption key more difficult.

  According to the access management system of claim 3, when generating the encryption key, in addition to the hash value of the full-text log and the hash value of the summary log, the character string generated based on the passwords of two or more administrators "You should require authentication of two or more managers when viewing log information mixed with credit card information" because the passphrase PCI DSS (Payment Card Industry Data Security Standard / Global security standard in the credit card industry) can be cleared.

FIG. 1 is a block diagram showing a usage form of an access management system according to the present invention. An access management system is provided between a client terminal 12 operated by a user and an EC (Electronic Commerce) server 14 used by the user. A state in which an access management server 16 for implementation is provided is depicted.
A management terminal 17 operated by a system administrator and a maintenance terminal 18 operated by a maintenance person are also connected to the access management server 16 via a communication network.

The access management server 16 has a function of recording data exchange between the client terminal 12 and the EC server 14 as log information one by one.
The log information itself consists of simple text data, but since this contains important personal information such as IDs, passwords, and credit card numbers, the access management server 16 encrypts the log information. In addition, it has a function of storing in a predetermined storage means.

  FIG. 2 is a block diagram showing the functional configuration of the access management server 16 in a scene where log information is encrypted and stored in the storage means. The log information generation unit 20, the hash value generation unit 22, and the hash value storage unit 24 A passphrase storage unit 26, an encryption key generation unit 28, an encryption processing unit 30, a log information storage unit 32, and a log information storage unit 34.

Among these functional components, the log information generation unit 20, the hash value generation unit 22, the encryption key generation unit 28, the encryption processing unit 30, and the log information storage unit 32 are the CPU of the access management server 16, the OS, and the application This is realized by executing predetermined processing according to a program.
The hash value storage unit 24, the passphrase storage unit 26, and the log information storage unit 34 are provided in the hard disk of the access management server 16.
The log information generation unit 20 is connected to the client terminal 12 operated by the user and the EC server 14 via a communication network.

Next, the processing procedure of the access management server 16 in the scene will be described with reference to the flowchart of FIG.
First, when communication is started between the client terminal 12 and the EC server 14, the log information generation unit 20 acquires data exchanged between the two one by one, and generates log information for each session (S10). .

The log information generated by the log information generation unit 20 includes a full-text log (operation log) 36 in which all data between both is described in a text format, and a summary log 38 used as index information of the session.
The summary log 38 is, for example, access start date / time, access end date / time, user account, connection source client, port number, connection destination server, outflow data (byte), inflow data (byte), connection time (second), etc. (See FIG. 6).

Next, the hash value generation unit 22 inputs the character string data of the full-text log 36 into a predetermined hash function, thereby generating a hash value of a predetermined bit length (for example, 128 bits), and a unique ID that identifies the session And stored in the hash value storage unit 24 (S12).
At the same time, the hash value generation unit 22 generates a hash value having a predetermined bit length (for example, 128 bits) by inputting the character string data of the summary log 38 into a predetermined hash function, and associates the hash value storage unit 24 with the ID. (S14).

Next, the encryption key generation unit 28 is activated, and the hash value of the full-text log stored in the hash value storage unit 24, the hash value of the summary log, and the passphrase stored in advance in the passphrase storage unit 26 are set to a predetermined encryption key. By entering the generation algorithm, an encryption key having a predetermined bit length (for example, 128 bits) is generated (S16).
As the passphrase, for example, a character string having a predetermined number of digits generated by performing a predetermined arithmetic process on login passwords of two or more system administrators corresponds to other passphrases. Also good.

  Next, the encryption processing unit 30 is activated, and the full-text log 36 is encrypted by applying a predetermined encryption algorithm using the encryption key passed from the encryption key generation unit 28 (S18). The encryption processing unit 30 deletes the encryption key from the memory after the encryption processing is completed (S20).

  Finally, the log information storage unit 32 stores the encrypted full text log 40 and the plain text summary log 38 in the log information storage unit 34 in association with the session (S22).

  FIG. 4 is a block diagram showing a functional configuration of the access management server 16 in a scene where log information is decrypted and displayed on the management terminal 17, and includes a log information presentation unit 42, a log information storage unit 34, and an encryption key generation unit 28, a hash value storage unit 24, a passphrase storage unit 26, and a decryption processing unit 44.

Among these functional components, the log information storage unit 34, the encryption key generation unit 28, the hash value storage unit 24, and the passphrase storage unit 26 are the same as those shown in FIG. The log information presentation unit 42 and the decryption processing unit 44 are realized by the CPU of the access management server 16 executing predetermined processing according to the OS and the application program.
A management terminal 17 operated by an administrator is connected to the log information presentation unit 42 via a communication network.

Next, the processing procedure of the access management server 16 in the scene will be described with reference to the flowchart of FIG.
First, when receiving a log information browsing request from the management terminal 17 (S30), the log information presentation unit 42 extracts a plurality of summary logs 38 from the log information storage unit 34, generates a list screen of log information, and manages the management terminal 17 (S32).

  FIG. 6 shows the display contents of this list screen. “Access start date / time”, “Access end date / time”, “user account”, “connection source client”, “port number” corresponding to the summary log of each session. In addition to the display items “connection destination server”, “outflow data (byte)”, “inflow data (byte)”, and “connection time (second)”, the display item “full text log download” is provided.

  In the display item of “full text log download”, an icon symbolizing the existence of the encrypted full text log is displayed. When the administrator moves the mouse pointer to an icon related to an arbitrary session and clicks, the management terminal 17 To the access management server 16, a full-text log browsing request relating to the session is transmitted.

  Upon receiving this, the log information presentation unit 42 (S34) requests the encryption key generation unit 28 to generate an encryption key, and the encryption key generation unit 28 uses the hash value of the full-text log and the hash of the summary log related to the session. The value is acquired from the hash value storage unit 24 (S36).

  Next, the encryption key generation unit 28 inputs the hash value of the full-text log and the hash value of the summary log, and the pass phrase stored in the pass phrase storage unit 26 into the same encryption key generation algorithm as described above. Thus, the same encryption key used when encrypting the full-text log is generated (S38).

  Next, the decryption processing unit 44 is activated, and the encrypted full-text log is decrypted based on the decryption algorithm corresponding to the encryption algorithm using the encryption key passed from the encryption key generating unit 28 (S40). After this decryption process is completed, the decryption processing unit 44 deletes the encryption key from the memory (S42).

Finally, the log information presentation unit 42 generates a display screen of the decrypted full-text log 40 and transmits it to the management terminal 17 (S44).
As a result, the description content of the full-text log 40 related to the specific session is displayed on the display of the management terminal 17 (not shown).

  According to this access management system, when encrypting each full-text log, based on the hash value generated from the full-text log, the hash value generated from the access log related to the full-text log, and the passphrase, A unique encryption key is generated on the spot, and this encryption key is deleted from the memory when encryption is completed, and is not stored in an external storage device. In addition, when decrypting each full-text log, the encryption key unique to the session is regenerated on the spot based on the hash value of the full-text log, the hash value of the access log related to the full-text log, and the passphrase. The encryption key is deleted from the memory when the decryption is completed, and is not stored in the external storage device. For this reason, encryption key management itself becomes unnecessary.

  The maintenance staff can access the access management server 16 from the maintenance terminal 18. However, even if the full text log stored in the log information storage unit 34 is viewed, these data are encrypted. Therefore, I cannot understand the contents.

  Similarly, even if the person in charge of maintenance can browse the hash value stored in the hash value storage unit 24, since the hash value has one-way (irreversible), the full-text log based on it must be reproduced. I can't.

  Furthermore, in the unlikely event that each hash value or encrypted full-text log data is altered, the encrypted full-text log should be decrypted using the encryption key generated based on the hash value or the like. It becomes possible to detect the fact of tampering at that time.

As mentioned above, by using a character string generated based on the login password of two or more administrators as a passphrase, it becomes possible to conform to the PCI DSS standard, but the passphrase is limited to this. Other character strings can be used as passphrases.
The use of a passphrase is not essential when generating an encryption key, and the encryption key may be generated based only on the hash value of the full-text log and the hash value of the summary log.

It is a block diagram which shows the utilization form of the access management system which concerns on this invention. It is a block diagram which shows the function structure of the access management server in the scene which encrypts log information and stores it in a memory | storage means. It is a flowchart which shows the process sequence of the access management server in the scene which encrypts log information and stores it in a memory | storage means. It is a block diagram which shows the function structure of the access management server in the scene where log information is decoded and displayed on a management terminal. It is a flowchart which shows the process sequence of an access management server in the scene where log information is decoded and displayed on a management terminal. It is a figure which illustrates the list screen of the log information displayed on the display of the management terminal. It is a block diagram which shows the utilization form of the conventional access management system.

12 Client terminal
14 EC server
16 Access management server
17 Management terminal
18 Maintenance terminal
20 Log information generator
22 Hash value generator
24 Hash value storage
26 Passphrase memory
28 Encryption key generator
30 Encryption processing section
32 Log information storage
34 Log information storage
36 Full text log
38 Summary Log
40 Encrypted full-text log
42 Log information presentation section
44 Decryption processor

Claims (3)

An access management system interposed between a client terminal and a server,
A means for generating a full-text log describing an operation history between the client terminal and the server, and a summary log that is an index of the full-text log for each session;
A hash value generating means for generating a hash value having a predetermined number of bits based on the description contents of the full-text log, generating a hash value having a predetermined number of bits based on the description contents of the summary log, and storing the hash value in the hash value storage means; ,
First encryption key generation means for generating an encryption key having a predetermined number of bits based on at least the hash value of the full-text log and the hash value of the summary log;
Means for encrypting the full-text log using this encryption key;
Means for deleting the encryption key from the memory;
Means for storing the encrypted full-text log in a log information storage means;
Means for acquiring a hash value of a corresponding full-text log and a hash value of a summary log from the hash value storage means when a log information browsing request relating to a specific session is input from a management terminal operated by an administrator;
Second encryption key generation means for generating the same encryption key as described above based on at least the hash value of the full-text log and the hash value of the summary log;
Means for decrypting the encrypted full-text log using the encryption key;
Means for deleting the encryption key from the memory;
Means for transmitting the decrypted full-text log to the management terminal;
An access management system comprising: A passphrase storage means for storing a passphrase composed of a predetermined character string;
The first encryption key generation means and the second encryption key generation means generate the encryption key using the passphrase in addition to the hash value of the full-text log and the hash value of the summary log. The access management system according to claim 1.   The access management system according to claim 2, wherein the passphrase includes a character string generated based on passwords of two or more managers.

Images