JP2013149109A - Security setting system, security setting method and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To efficiently set signature data suitable for each virtual machine.SOLUTION: A security setting system 100 acquires identification information on a virtual machine image of a virtual machine to be started and virtual machine identification information, and specifies corresponding signature identification information. A signature file corresponding to the specified signature identification information is stored by making the signature file correspond to the acquired virtual machine identification information. The security setting system 100 starts the virtual machine to be started on the basis of the storage of the signature file, and limits communication for the virtual machine when it is determined that communication data to be detected is included in communication data for the started virtual machine.

Description

  The present invention relates to a security setting system, a security setting method, and a program.

  In recent years, with the development of ADSL networks and optical fiber networks and the enhancement of various network services, the number of devices connected to the network has increased dramatically, and network security problems have become prominent. .

  Examples of network security issues include computer viruses that infect and propagate devices that exploit network device vulnerabilities, device vulnerabilities and user setting errors, and take control of network devices. There is unauthorized access such as stealing or destroying the data recorded inside.

  In order to prevent such an attack from an external network, techniques for detecting fraud such as IDS (Intrusion Detection System) and IPS (Intrusion Protection System) are generally used. IDS and IPS are systems that detect unauthorized access and viruses as unauthorized attacks. IDS notifies administrators of unauthorized attacks, while IPS notifies administrators and automatically blocks communications. To do.

  As such IDS and IPS, a technique has been proposed in which signature data characterizing unauthorized access and computer virus is distributed and monitored via a network (for example, Patent Document 1).

JP 2007-11628 A

  However, when the technology of Patent Document 1 is applied to a virtualization platform that operates a virtual machine, it is assumed that many virtual machines are activated, and signature data that conforms to the OS and security requirements of each virtual machine is assumed. It becomes difficult to set. Further, when setting signature data suitable for the OS and security requirements of each virtual machine, the administrator needs to manually set signature data corresponding to each virtual machine and distribute it for each virtual machine. Therefore, it is still not enough from the viewpoint of efficiently setting signature data suitable for each virtual machine.

  The present invention has been made in view of the circumstances as described above, and an object thereof is to provide a security setting system, a security setting method, and a program capable of efficiently setting signature data suitable for each virtual machine. Yes.

In order to achieve the above object, a security setting system according to the first aspect of the present invention provides:
A virtual machine image identification information acquisition means for acquiring identification information of a virtual machine image that defines a virtual machine to be started;
Virtual machine identification information acquisition means for acquiring virtual machine identification information for identifying the virtual machine to be activated;
Signature identification information storage means for storing signature identification information for identifying a signature file including communication data to be detected for a virtual machine activated based on the virtual machine image in association with the identification information of the virtual machine image When,
Signature identification information specifying means for specifying the signature identification information corresponding to the virtual machine image identification information acquired by the virtual machine image identification information acquisition means based on the signature identification information stored in the signature identification information storage means;
Signature file storage means for storing the virtual machine identification information acquired by the virtual machine identification information acquisition means in association with the signature file indicated by the signature identification information specified by the signature identification information specifying means;
Virtual machine activation means for activating the virtual machine to be activated in response to the signature file being stored by the signature file storage means;
It is determined based on a signature file stored in the signature file storage means whether or not the communication data to be detected is included in the communication data for the virtual machine activated by the virtual machine activation means, and the communication to be detected Communication limiting means for limiting communication to the virtual machine when it is determined that data is included;
It is characterized by providing.

The communication control means includes
Virtual machine identification information storage means for storing virtual machine identification information of a virtual machine requested to be used and operation information indicating communication data for the virtual machine;
Signature file acquisition means for acquiring a signature file corresponding to the virtual machine identification information stored in the virtual machine identification information storage means among the signature files stored in the signature file storage means;
Unauthorized communication determination means for determining the presence or absence of communication data to be detected by comparing the contents of the signature file acquired by the signature file acquisition means and the contents of the operation information stored in the virtual machine identification information storage means;
An unauthorized communication notification means for notifying that an unauthorized communication is being performed via the network to an administrator terminal of the virtual machine when it is determined by the unauthorized communication determination means that there is communication data to be detected;
May be further provided.

The virtual machine identification information storage means acquires the virtual machine identification information and the operation information from a communication terminal used by a user who requests use of a virtual machine via a network.
The unauthorized communication notifying means interrupts communication with the communication terminal when it is determined that there is communication data to be detected by the unauthorized communication determining means.
You may do it.

In order to achieve the above object, a security setting method according to the second aspect of the present invention includes:
A virtual machine image identification information acquisition step for acquiring identification information of a virtual machine image defining a virtual machine to be started;
A virtual machine identification information acquisition step for acquiring virtual machine identification information for identifying the virtual machine to be activated;
Signature identification information storing step for storing signature identification information for identifying a signature file including communication data to be detected for a virtual machine activated based on the virtual machine image in association with the identification information of the virtual machine image When,
A signature identification information specifying step for specifying the signature identification information corresponding to the virtual machine image identification information acquired in the virtual machine image identification information acquisition step based on the signature identification information stored in the signature identification information storage step;
A signature file storage step for storing the virtual machine identification information acquired in the virtual machine identification information acquisition step in association with the signature file indicated by the signature identification information specified in the signature identification information specification step;
A virtual machine starting step of starting the virtual machine to be started in response to the signature file being stored by the signature file storing step;
It is determined based on the signature file stored in the signature file storage step whether or not the communication data to be detected is included in the communication data for the virtual machine activated in the virtual machine activation step, and the communication to be detected A communication restriction step for restricting communication to the virtual machine when it is determined that data is included;
It is characterized by providing.

In order to achieve the above object, a program according to the third aspect of the present invention provides:
Computer
Virtual machine image identification information acquisition means for acquiring identification information of a virtual machine image defining a virtual machine to be started,
Virtual machine identification information acquisition means for acquiring virtual machine identification information for identifying the virtual machine to be activated,
Signature identification information storage means for storing signature identification information for identifying a signature file including communication data to be detected for a virtual machine activated based on the virtual machine image in association with the identification information of the virtual machine image ,
Signature identification information specifying means for specifying the signature identification information corresponding to the virtual machine image identification information acquired by the virtual machine image identification information acquisition means based on the signature identification information stored in the signature identification information storage means;
Signature file storage means for storing the virtual machine identification information acquired by the virtual machine identification information acquisition means in association with the signature file indicated by the signature identification information specified by the signature identification information specifying means;
Virtual machine activation means for activating the virtual machine to be activated in response to the signature file being stored by the signature file storage means;
It is determined based on a signature file stored in the signature file storage means whether or not the communication data to be detected is included in the communication data for the virtual machine activated by the virtual machine activation means, and the communication to be detected Communication restriction means for restricting communication to the virtual machine when it is determined that data is included;
It is made to function as.

  According to the present invention, it is possible to provide a security setting system, a security setting method, and a program that can efficiently set signature data suitable for each virtual machine.

It is a block diagram which shows an example of the security setting system which concerns on embodiment of this invention. It is a figure which shows the structural example of signature management DB. It is a figure which shows the structural example of virtual machine image management DB. It is a flowchart which shows an example of a setting process. It is a figure which shows an example of virtual signature management DB. It is a flowchart which shows an example of a collation process.

  Hereinafter, a security setting system according to an embodiment of the present invention will be described with reference to the drawings.

  The security setting system 100 according to the present embodiment includes a virtual machine management device 200 and a DB server 300. The security setting system 100 manages, on the DB server 300, signatures that are preliminarily created and matched with the OSs and functions of a plurality of virtual machines that operate on the virtualization infrastructure, This is a computer system operated by program control that searches, distributes, and sets a signature corresponding to each virtual machine from a database.

  The virtual machine management apparatus 200 is a computer that mainly sets signature data for a virtual machine that is requested to start in response to an input operation from a virtual machine administrator. As shown in FIG. 210, a control unit 220, a communication unit 230, and a system bus 240 that connects the above units to each other.

  The storage unit 210 includes a nonvolatile memory such as a flash memory and a hard disk, and stores a program for realizing each functional unit of the control unit 220 and a list of virtual machine identification information. In addition, the storage unit 210 stores a virtual signature management table that associates one virtual machine identification information with a plurality of signature files by processing to be described later.

  The control unit 220 includes a CPU and the like. The control unit 220 operates in accordance with a program and performs setting processing for setting signature data suitable for a virtual machine requested to be started, and verification processing for matching packets according to a virtual machine usage request from a virtual machine user. Provide necessary functions. The control unit 220 includes a virtual machine management unit 221, a signature management unit 222, and a packet monitoring unit 223 as main functional units provided by the program.

  As will be described in detail later, the virtual machine management unit 221 creates a virtual machine identification information uniquely corresponding to a virtual machine requested to start according to a list of virtual machine identification information stored in the storage unit 210, and a signature. The management unit 222 has a function for requesting acquisition of corresponding signature data and a function for starting a virtual machine requested to start.

  As will be described in detail later, the signature management unit 222 requests the DB server 300 to search and acquire corresponding signature data in response to a request from the virtual machine management unit 221, and the acquired signature data is stored in the signature management table. As a storage unit 210.

  As will be described later in detail, the packet monitoring unit 223 refers to the signature ID management table stored in the storage unit 210 in response to a usage request from a user of the virtual machine, and performs packet pattern matching. It has a function to determine access permission to.

  The communication unit 230 has a serial interface or an analog interface for receiving an analog signal. The communication unit 230 communicates with the DB server 300 under the control of the control unit 220.

  The DB server 300 is a computer that searches for corresponding signature data in accordance with an instruction from the virtual machine management apparatus 200 and provides the signature data to the virtual machine management apparatus 200. The DB server 300 stores a signature management DB as shown in FIG. 2 and a virtual machine image management DB as shown in FIG. The signature management DB shown in FIG. 2 includes a signature file management table and a signature ID management table. The signature file management table includes a signature file that defines unauthorized access and virus information for each signature identification information that identifies a signature. Is a table associated with. The signature file includes processing performed when unauthorized access or a virus is detected. The signature ID management table is a table in which signature identification information is associated with each virtual machine identification information for identifying a virtual machine image. The virtual machine image management DB illustrated in FIG. 3 includes a virtual machine image management table. The virtual machine image management table is a table in which a virtual machine image file name that identifies a virtual machine image file is associated with virtual machine identification information that identifies a virtual machine image.

  The DB server 300 searches a stored virtual machine image file and signature file from various stored tables in accordance with a request from the virtual machine management apparatus 200 and provides the virtual machine image file and signature file to the virtual machine management apparatus 200.

  The above is the configuration of the security setting system 100. Next, the operation of the security setting system 100 will be described with reference to FIGS.

  First, the operation of the security setting system 100 in the setting process will be described with reference to FIG. The setting process is started by receiving a virtual machine activation request via the communication unit 230 by a computer input operation by a virtual machine administrator.

  The control unit 220 acquires a virtual machine activation request by the function of the virtual machine management unit 221 (step S101). The virtual machine activation request includes virtual machine image identification information of the virtual machine requested to be activated.

  Then, the virtual machine management unit 221 generates virtual machine identification information by, for example, selecting arbitrary identification information from a plurality of virtual machine identification information included in the virtual machine identification information list stored in the storage unit 210. (Step S102). Note that the virtual machine identification information once selected is controlled by the virtual machine management unit 221 so that it is not selected again until the activation of the virtual machine is completed. When there are a plurality of virtual machines that request activation, virtual machine identification information is generated for each request.

  Subsequently, the virtual machine management unit 221 transmits the virtual machine image identification information to the DB server 300 via the communication unit 230, and requests transmission of the virtual machine image file (step S103). The virtual machine image file is a configuration information definition file that defines the configuration of the virtual machine to be started, and is referred to when starting the virtual machine.

  When the DB server 300 receives the virtual machine image identification information from the virtual machine management apparatus 200, the DB server 300 starts a search process for searching and providing data according to a request from the virtual machine management apparatus 200. First, the DB server 300 searches for and specifies a virtual machine image file corresponding to the virtual machine image identification information by referring to the virtual machine image management DB (step S201). Then, the DB server 300 transmits the identified virtual machine image file to the virtual machine management apparatus 200 as a search result (step S202).

  When the control unit 220 of the virtual machine management apparatus 200 acquires the virtual machine image file via the communication unit 230 by the function of the virtual machine management unit 221, the virtual machine identification information and the virtual machine image identification information are sent to the signature management unit 222. hand over. When the signature management unit 222 acquires the virtual machine identification information and the virtual machine image identification information, the signature management unit 222 transmits the acquired virtual machine image identification information to the DB server 300 via the communication unit 230 to request transmission of the signature file. (Step S104).

  When receiving the virtual machine image identification information from the virtual machine management apparatus 200, the DB server 300 identifies signature identification information corresponding to the virtual machine image identification information with reference to the signature ID management table (step S203). Subsequently, the DB server 300 specifies a signature file corresponding to the signature identification information specified in the process of step S203 with reference to the signature file management table (step S204). After the process of step S204, the DB server 300 identifies and transmits the signature file to the virtual machine management apparatus 200 (step S205), and ends the process.

  When the control unit 220 of the virtual machine management apparatus 200 acquires the signature file via the communication unit 230 by the function of the signature management unit 222, as illustrated in FIG. 5, the acquired signature file is acquired in the process of step S104. The information is stored in the signature management table of the virtual signature management DB in the storage unit 210 in association with the machine identification information (step S105). After the processing in step S106, the signature management unit 222 passes a storage completion notification indicating that the storage in the signature ID management table has been normally performed to the virtual machine management unit 221.

  Returning to FIG. 4, when the virtual machine management unit 221 obtains the storage completion notification, the virtual machine manager requested to start based on the virtual machine image file transmitted from the DB server 300 in the process of step S202. The virtual machine is activated (step S106).

  After the process of step S106, the virtual machine management unit 221 transmits a start completion notification indicating that the start of the virtual machine is completed to the administrator of the virtual machine via the communication unit 230 (step S107), and the setting process Exit.

  Next, the operation of the security setting system 100 in the verification process will be described with reference to FIG. The verification process is a process for monitoring communication of a target virtual machine, and is started when the virtual machine is activated. Here, an example of monitoring communication when a use request for a virtual machine is transmitted by a user of the virtual machine will be described.

  The control unit 220 acquires a virtual machine use request by the function of the packet monitoring unit 223 (step S301). The use request for the virtual machine includes virtual machine identification information of the virtual machine requested to be used, and operation information indicating the contents of processing on the virtual machine and the contents of communication data. Since the security setting system 100 monitors all communication with the virtual machine, the security setting system 100 has a function of acquiring not only a use request but also a communication destination, a port number, a protocol, and a packet data portion, for example.

  Subsequently, based on the acquired virtual machine identification information, the packet monitoring unit 223 searches for and identifies a signature file corresponding to the virtual machine identification information from the virtual signature management table stored in the storage unit 210 (step). S302). The packet monitoring unit 223 collates the contents of the signature file with the operation information included in the virtual machine use request acquired in step S301 by referring to the signature file specified in step S302. It is determined whether or not the packet is an illegal packet (step S303).

  In the process of step S303, for example, whether or not the packet pattern of the communication data packet indicated by the operation information is included in the signature file specified in the process of step S302, the contents (signature data) of the signature file are determined. Judgment by reference. The packet monitoring unit 223 determines that the packet is an illegal packet when the signature file includes the packet pattern, and determines that the packet is not an illegal packet when the signature file does not include the packet pattern.

  If it is determined in step S303 that the packet is not an illegal packet (step S303; No), the packet monitoring unit 223 permits access to the virtual machine specified by the virtual machine use request acquired in step S301. Then, the operation specified by the operation information is started (step S304), and the process is terminated.

  On the other hand, if it is determined in step S303 that the packet is an illegal packet (step S303; Yes), the packet monitoring unit 223 depends on whether the security setting system 100 employs IDS or IPS. Processing is performed (step S306), and the processing is terminated.

  For example, when the security setting system 100 employs IDS, fraud detection information indicating that a fraudulent packet has been detected is transmitted to the administrator of the virtual machine, and when IPS is employed, When an illegal packet is detected, the packet is discarded and notified to the virtual machine administrator and user. In this example, the process of monitoring communication with the virtual machine in the verification process in the security setting system 100 has been described. However, the security setting system 100 performs communication from the monitored virtual machine to a user terminal or the like. Monitoring can be performed in a similar manner.

  The operation of the security setting system 100 has been described above. According to such a configuration, the signature identification information corresponding to the virtual machine image identification information for identifying the virtual machine image is specified, and the signature file identified by the specified signature identification information is dynamically set. Become. Therefore, signature data suitable for each virtual machine can be set efficiently. In addition, since signature data is set dynamically at the same time as each virtual machine is started, the time lag from the start of the virtual machine to the setting of the signature data is eliminated, and attacks such as unauthorized access during that time can be prevented. .

(Modification)
The present invention is not limited to the above-described embodiment, and various modifications and applications are possible. In the setting process shown in FIG. 4, the example in which the process in step S103 and the processes in steps S201 to S202 are executed after the process in step S102 is shown, but this is an example. The processing in step S103 and the processing in steps S201 to S202 may be executed after the processing in step S105 and before the virtual machine is started in step S106.

  In the above embodiment, the security setting system 100 includes the virtual machine management apparatus 200 and the DB server 300. However, the virtual machine management apparatus 200 includes the signature management DB and the virtual server included in the DB server 300. If the machine image management DB is provided, the security setting system 100 may be configured from the virtual machine management device 200.

  In the above-described embodiment, an example in which each process is executed by the virtual machine management apparatus 200 having a physical configuration has been described. For example, virtualization software stored in advance on a server (not shown) may be activated, and each configuration in the virtual machine management apparatus 200 may be used in a virtualization environment. That is, the virtual machine management apparatus 200 itself may be a virtual server.

  In the above embodiment, in the process of step S105, an example is shown in which the signature file is associated with the virtual machine identification information and stored in the signature management table of the virtual signature management DB. However, the virtual signature management table is It may be editable by the administrator of the virtual machine. In this case, it is desirable to change the file name of the signature file after editing.

  Further, when the above-described functions are realized by sharing between an OS (Operating System) and an application, or by cooperation between the OS and the application, only a part other than the OS may be stored in the medium.

  It is also possible to superimpose a program on a carrier wave and distribute it via a communication network. For example, the program may be posted on a bulletin board (BBS, Bulletin Board System) on a communication network, and the program may be distributed via the network. Then, the above-described processing may be executed by starting these programs and executing them in the same manner as other application programs under the control of the operating system.

DESCRIPTION OF SYMBOLS 100 Security setting system 200 Virtual machine management apparatus 210 Memory | storage part 220 Control part 221 Virtual machine management part 222 Signature management part 223 Packet monitoring part 230 Communication part 240 System bus 300 DB server

Claims (5)

A virtual machine image identification information acquisition means for acquiring identification information of a virtual machine image that defines a virtual machine to be started;
Virtual machine identification information acquisition means for acquiring virtual machine identification information for identifying the virtual machine to be activated;
Signature identification information storage means for storing signature identification information for identifying a signature file including communication data to be detected for a virtual machine activated based on the virtual machine image in association with the identification information of the virtual machine image When,
Signature identification information specifying means for specifying the signature identification information corresponding to the virtual machine image identification information acquired by the virtual machine image identification information acquisition means based on the signature identification information stored in the signature identification information storage means;
Signature file storage means for storing the virtual machine identification information acquired by the virtual machine identification information acquisition means in association with the signature file indicated by the signature identification information specified by the signature identification information specifying means;
Virtual machine activation means for activating the virtual machine to be activated in response to the signature file being stored by the signature file storage means;
It is determined based on a signature file stored in the signature file storage means whether or not the communication data to be detected is included in the communication data for the virtual machine activated by the virtual machine activation means, and the communication to be detected Communication limiting means for limiting communication to the virtual machine when it is determined that data is included;
A security setting system comprising: The communication control means includes
Virtual machine identification information storage means for storing virtual machine identification information of a virtual machine requested to be used and operation information indicating communication data for the virtual machine;
Signature file acquisition means for acquiring a signature file corresponding to the virtual machine identification information stored in the virtual machine identification information storage means among the signature files stored in the signature file storage means;
Unauthorized communication determination means for determining the presence or absence of communication data to be detected by comparing the contents of the signature file acquired by the signature file acquisition means and the contents of the operation information stored in the virtual machine identification information storage means;
An unauthorized communication notification means for notifying that an unauthorized communication is being performed via the network to an administrator terminal of the virtual machine when it is determined by the unauthorized communication determination means that there is communication data to be detected;
The security setting system according to claim 1, further comprising: The virtual machine identification information storage means acquires the virtual machine identification information and the operation information from a communication terminal used by a user who requests use of a virtual machine via a network.
The unauthorized communication notifying means interrupts communication with the communication terminal when it is determined that there is communication data to be detected by the unauthorized communication determining means.
The security setting system according to claim 2. A virtual machine image identification information acquisition step for acquiring identification information of a virtual machine image defining a virtual machine to be started;
A virtual machine identification information acquisition step for acquiring virtual machine identification information for identifying the virtual machine to be activated;
Signature identification information storing step for storing signature identification information for identifying a signature file including communication data to be detected for a virtual machine activated based on the virtual machine image in association with the identification information of the virtual machine image When,
A signature identification information specifying step for specifying the signature identification information corresponding to the virtual machine image identification information acquired in the virtual machine image identification information acquisition step based on the signature identification information stored in the signature identification information storage step;
A signature file storage step for storing the virtual machine identification information acquired in the virtual machine identification information acquisition step in association with the signature file indicated by the signature identification information specified in the signature identification information specification step;
A virtual machine starting step of starting the virtual machine to be started in response to the signature file being stored by the signature file storing step;
It is determined based on the signature file stored in the signature file storage step whether or not the communication data to be detected is included in the communication data for the virtual machine activated in the virtual machine activation step, and the communication to be detected A communication restriction step for restricting communication to the virtual machine when it is determined that data is included;
A security setting method comprising: Computer
Virtual machine image identification information acquisition means for acquiring identification information of a virtual machine image defining a virtual machine to be started,
Virtual machine identification information acquisition means for acquiring virtual machine identification information for identifying the virtual machine to be activated,
Signature identification information storage means for storing signature identification information for identifying a signature file including communication data to be detected for a virtual machine activated based on the virtual machine image in association with the identification information of the virtual machine image ,
Signature identification information specifying means for specifying the signature identification information corresponding to the virtual machine image identification information acquired by the virtual machine image identification information acquisition means based on the signature identification information stored in the signature identification information storage means;
Signature file storage means for storing the virtual machine identification information acquired by the virtual machine identification information acquisition means in association with the signature file indicated by the signature identification information specified by the signature identification information specifying means;
Virtual machine activation means for activating the virtual machine to be activated in response to the signature file being stored by the signature file storage means;
It is determined based on a signature file stored in the signature file storage means whether or not the communication data to be detected is included in the communication data for the virtual machine activated by the virtual machine activation means, and the communication to be detected Communication restriction means for restricting communication to the virtual machine when it is determined that data is included;
A program characterized by functioning as

Images